CVE-2026-96636 in Pillow
Summary
by MITRE • 10/21/2026
Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DCX frames and replace self._size without rerunning Image._decompression_bomb_check(). A crafted multi-frame image can use a tiny first frame to pass Image.open() and then declare an over-limit later frame. Normal frame iteration through seek(), load(), or ImageSequence.Iterator can decode that frame and commit hundreds of megabytes or more, causing memory-exhaustion denial of service. This issue is fixed in version 13.0.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in the Pillow imaging library prior to version 13.0.0 represents a critical logic flaw within the handling of multi-frame image formats, specifically MPO and DCX structures. As a widely adopted Python library for opening, manipulating, and saving various image file formats, Pillow is frequently used in web applications, automated processing pipelines, and data analysis tools where untrusted or user-uploaded images are processed. The core issue stems from the implementation of the seek() methods within MpoImageFile and DcxImageFile classes. These methods are responsible for navigating between frames in multi-frame files by re-parsing frame headers to update internal state variables such as self._size, which defines the dimensions of the current image data being accessed. However, this process fails to trigger a subsequent check against Image._decompression_bomb_check(), a security mechanism designed to prevent memory exhaustion attacks by limiting the maximum size of decoded images based on configurable thresholds.
This architectural oversight creates a specific attack vector where an adversary can craft a malicious multi-frame image file that exploits the discrepancy between initial validation and dynamic frame switching. The attacker constructs a file with a first frame that is intentionally small, allowing it to pass the Image.open() initialization checks without triggering any size-related alarms or resource limits. Once the application begins processing the image, typically through normal iteration methods such as seek(), load(), or ImageSequence.Iterator, the library switches focus to subsequent frames within the same file. These later frames can declare dimensions that are significantly larger than the allowed limit, effectively bypassing the initial security controls because the decompression bomb check is not re-evaluated when changing frames via these specific API calls.
The operational impact of this vulnerability is a severe denial-of-service condition characterized by memory exhaustion. When an application processes such a crafted image and attempts to decode or load one of the oversized later frames, Pillow allocates memory proportional to the declared dimensions of that frame rather than its actual compressed size. This can result in the allocation of hundreds of megabytes or even gigabytes of RAM for a single image operation, depending on the system's configuration and available resources. For services handling high volumes of image uploads, such as social media platforms, e-commerce sites with product images, or automated document processing systems, this flaw can lead to rapid resource depletion, causing service crashes, application timeouts, or complete unavailability for legitimate users. The attack does not require code execution but relies on the target system's willingness to process standard image formats through vulnerable versions of Pillow.
From a classification perspective, this vulnerability aligns with CWE-400: Uncontrolled Resource Consumption, as it allows an attacker to consume excessive memory resources by exploiting improper validation during state transitions within multi-frame parsing logic. It also relates to CWE-20: Improper Input Validation, specifically the failure to validate input data against security constraints after initial checks have passed. In terms of offensive cybersecurity frameworks, this behavior is consistent with ATT&CK technique T1496: Resource Hijacking, where an attacker uses computing resources for their own benefit or causes disruption by exhausting system capacity. The specific mechanism involves manipulating file structure parsing to bypass size limits, which falls under the broader category of input validation flaws in media processing libraries.
Mitigation strategies primarily involve upgrading the Pillow library to version 13.0.0 or later, where this logic flaw has been corrected to ensure that decompression bomb checks are consistently applied regardless of frame navigation methods. For environments unable to immediately upgrade, defensive coding practices should be implemented within application layers consuming Pillow. This includes implementing custom size validation wrappers around image loading operations, setting explicit limits on maximum pixel dimensions before calling load() or iterating through frames, and monitoring memory usage during image processing tasks. Additionally, organizations should review their input validation pipelines to ensure that multi-frame images are validated for all frame sizes upon initial open, rather than relying solely on the first frame's metadata. Regular security audits of third-party dependencies and maintaining an up-to-date inventory of library versions are essential practices to prevent exploitation of such known vulnerabilities in production environments.