CVE-2026-96639 in Pillow
Summary
by MITRE • 10/23/2026
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the stale native storage because _im is non-null without verifying that its mode and size still match. Crafted PSD, MPO, DCX, or MIC frame transitions can then write wider pixels into the narrow allocation, causing native out-of-bounds writes and crashes. The MPO path can also cause a native over-read and, in demonstrated runtime-specific profiles, command execution. This issue is fixed in version 13.0.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified within the Pillow imaging library affects versions ranging from 11.0.0 through 13.0.0, representing a critical flaw in how multi-frame image formats are processed during memory allocation and data loading phases. Pillow is widely utilized for handling various raster graphics operations, including opening, manipulating, and saving different image file formats. The core issue stems from the internal logic governing frame transitions within multi-frame files such as PSD, MPO, DCX, or MIC. When processing these complex formats, the library employs a mechanism to optimize performance by reusing existing native storage allocations rather than allocating new memory for every frame change. This optimization relies on the assumption that if an ImagingCore object exists and is non-null, its dimensions and data mode remain compatible with subsequent frames of identical pixel dimensions but potentially different color modes.
The technical flaw arises when a later frame in a multi-frame sequence changes the logical image mode from a narrow format to a wider one, such as RGB or CMYK, while maintaining the same spatial resolution. In this scenario, the ImageFile.load_prepare function incorrectly reuses the stale native storage allocated for the narrower initial mode without verifying that its capacity matches the requirements of the new, wider data structure. This lack of validation allows crafted inputs to exploit a type confusion-like state where the internal representation does not align with the actual memory layout expectations. Consequently, when the decoder attempts to write pixel data using the wider stride and channel count associated with RGB or CMYK modes into an allocation sized for a narrower mode like grayscale or palette-based images, it triggers native out-of-bounds writes. This memory corruption manifests as application crashes due to segmentation faults or access violations in standard usage scenarios.
Beyond simple denial of service through crashing, the implications are significantly more severe depending on the specific image format and runtime environment. The MPO (Multi-Picture Object) path has been demonstrated to cause native over-reads, which can lead to information disclosure if sensitive data residing adjacent to the allocated buffer is leaked into application memory. More critically, in certain runtime-specific profiles and execution contexts, this out-of-bounds write condition can be leveraged for arbitrary code execution. By carefully crafting frame transitions that manipulate pointer values or overwrite function pointers within the native C extensions of Pillow, an attacker could potentially achieve remote code execution on systems processing untrusted multi-frame images. This elevates the vulnerability from a simple stability issue to a high-severity security risk capable of compromising system integrity and confidentiality.
From a classification perspective, this vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input Classic buffer overflow and CWE-787 Out-of-bounds Write, as it involves writing data beyond the allocated memory boundaries due to insufficient size verification. The exploitation technique relates to ATT&CK T1499 Endpoint Denial of Service for crashes and potentially T1059 Command and Scripting Interpreter if code execution is achieved via script-based payloads embedded in image metadata or through subsequent library calls that interpret corrupted state. The root cause lies in the failure to validate object state consistency before reusing resources, a common pattern in C/C++ based libraries where manual memory management introduces complexity and risk of logical errors during dynamic type transitions.
Mitigation strategies primarily involve upgrading to Pillow version 13.0.0 or later, which includes patches that enforce strict validation of mode and size compatibility before reusing native storage allocations. For environments unable to upgrade immediately, input sanitization is recommended, specifically filtering out multi-frame formats like PSD, MPO, DCX, and MIC from untrusted sources until the patch can be applied. Additionally, deploying runtime application self-protection tools or memory safety wrappers may help detect abnormal memory access patterns associated with this vulnerability. Organizations should also audit their image processing pipelines to ensure that images are validated for expected properties before being passed to vulnerable library versions, thereby reducing the attack surface exposed by these specific multi-frame parsing routines.