[pkg-vuln] CVE-2026-96639 in pillow@12.1.1 #1244

New Issue

kert · 2026-10-25T18:53:39Z

kert commented

2026-10-25 18:53:39 +00:00

Severity: CRITICAL
Package: pillow @ 12.1.1
Fixed in: 13.0.0

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the stale native storage because _im is non-null without verifying that its mode and size still match. Crafted PSD, MPO, DCX, or MIC frame transitions can then write wider pixels into the narrow allocatio

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-96639

**Severity:** CRITICAL **Package:** `pillow` @ `12.1.1` **Fixed in:** `13.0.0` Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the stale native storage because _im is non-null without verifying that its mode and size still match. Crafted PSD, MPO, DCX, or MIC frame transitions can then write wider pixels into the narrow allocatio **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-96639

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-10-25 18:53:39 +00:00

kert added the quality ci labels 2026-10-25 18:53:39 +00:00

kert closed this issue

2026-10-27 16:15:29 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#1244