CVE-2026-96638

What it actually does

BmpRleDecoder.decode() in Pillow permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining dest_length without per-branch caps, allowing a kilobyte-sized input to expand a bytearray to hundreds of megabytes and exhaust memory.

Why it matters to the business

Services that accept or process BMP images can be forced offline by memory exhaustion, leading to downtime for image-handling applications and increased operational costs until the workload is restored.

How an attack unfolds

An attacker creates a small BMP file containing RLE delta or absolute-mode sequences that repeatedly exceed dest_length checks; when the target decodes the image the data structure grows unchecked until the process or host runs out of memory.

How to fix it

Upgrade Pillow to version 13.0.0 or later; rebuild and redeploy all dependent applications; consider temporary input-size or format restrictions until the update is complete.

How to confirm the fix worked

Confirm Pillow version is 13.0.0 or newer; run the library test suite against known RLE delta test vectors; monitor memory usage while decoding a set of crafted BMP files.

Typical attack path

1. Craft a malicious RLE-encoded BMP file with oversized delta or absolute runs
2. Deliver the file via upload, email attachment, or web request
3. Trigger Pillow BmpImagePlugin decoding on the file
4. Observe repeated unchecked appends that exhaust available memory

How to detect it

Monitor process memory growth and OOM events during image decoding; inspect application logs for repeated BMP decode operations on small files; correlate with inbound BMP uploads or attachments.

What your security team should do

• Immediately upgrade all Pillow installations to 13.0.0
• Add file-type and size validation before image decoding
• Enable resource limits on worker processes that handle untrusted images
• Review and restrict BMP support if the format is not required