CVE-2026-96644 in Pillow
Summary
by MITRE • 10/21/2026
Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using the original full dimensions. A crafted wide, short metafile can pass the pixel-count decompression-bomb check and make the Windows-only renderer read beyond the heap buffer, potentially disclosing memory or crashing the process. This issue is fixed in version 13.0.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Pillow versions prior to 13.0.0 represents a critical integer truncation flaw within the Windows-specific rendering pipeline for Window Metafile formats. Specifically, the WmfImagePlugin.py module interacts with native C code via src/display.c when processing WMF and Enhanced Metafile (EMF) images. The core technical failure lies in how dimension parameters are passed from the Python layer to the native drawwmf handler. While the plugin correctly retrieves full 32-bit width and height values, it fails to validate these dimensions against potential truncation issues before invoking the underlying C function responsible for rendering. This lack of validation allows a crafted input file with specific dimensional properties to exploit a mismatch between allocation size and data copy operations within the native code.
The operational mechanism of this vulnerability relies on a discrepancy in how memory is allocated versus how it is accessed during image processing. The native handler allocates a Device Independent Bitmap buffer based on 16-bit truncated values derived from the bcWidth and bcHeight fields found in the metafile header. This truncation effectively reduces the perceived size of the required memory block, often resulting in an allocation that is significantly smaller than what would be needed for the full image dimensions. However, when it comes to copying pixel data into this buffer, the handler utilizes the original, untruncated 32-bit dimensions provided by the plugin. This creates a classic heap-based out-of-bounds write scenario where the copy operation exceeds the bounds of the allocated memory region.
This architectural flaw leads to severe security implications for systems running affected versions on Windows operating systems. Because the pixel data is copied beyond the boundaries of the allocated DIB buffer, an attacker can craft a metafile with dimensions that are wide but short enough to bypass standard decompression bomb checks designed to prevent denial-of-service attacks via excessive memory consumption. By slipping past these size-based defenses while still triggering the out-of-bounds write, the vulnerability allows for arbitrary heap writes. Such conditions enable potential information disclosure by reading adjacent sensitive data from the process memory space or can lead to application crashes through stack corruption and access violations. In more sophisticated attack scenarios, this could potentially be leveraged for remote code execution if specific heap grooming techniques are employed alongside other exploitation primitives.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound, as the truncation of 32-bit values to 16 bits results in an incorrect calculation of buffer size relative to actual data volume. It also maps closely to CWE-787 Out-of-bounds Write, given that the memory copy operation exceeds the allocated heap region. In terms of adversarial tactics, this flaw facilitates initial access and potential privilege escalation vectors described within MITRE ATT&CK techniques related to exploitation for credential dumping or process injection via memory corruption. The specific context is limited to Windows environments due to its reliance on native GDI+ rendering components that are not present in the same manner on Linux or macOS platforms.
Mitigation strategies primarily involve upgrading Pillow to version 13.0.0 or later, where this integer truncation issue has been resolved through improved validation and type safety checks before passing parameters to native handlers. For environments unable to immediately upgrade, implementing strict input sanitization for WMF/EMF files is recommended, including validating that width and height dimensions do not exceed safe thresholds compatible with 16-bit representations if such legacy support must be maintained. Additionally, deploying runtime application self-protection tools or memory corruption mitigations like Data Execution Prevention can help reduce the likelihood of successful exploitation by preventing code execution from heap regions, although these are compensating controls rather than definitive fixes for the underlying logic error.