Cloudanix VulnDB

CVE-2026-96639

Critical · 9.8

CVSS

9.8

EPSS

0.7%

Published

Oct 21, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in an image-handling library can let attackers crash programs or take over systems simply by supplying a specially made picture file.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Remote Code Execution
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Multi-frame image loaders retain a stale ImagingCore allocation sized for a narrow mode while subsequent frames switch to wider RGB/CMYK modes and tiles; ImageFile.load_prepare() reuses the mismatched native buffer without validation, enabling out-of-bounds writes (and possible over-reads on MPO) that corrupt memory and can lead to crashes or code execution.

Why it matters to the business

Processing untrusted multi-frame images (PSD, MPO, DCX, MIC) can crash services or allow remote code execution, resulting in application downtime, data exposure, or full system compromise; the four-day-old high-severity flaw affects any Pillow 11.x–12.x deployment handling such formats.

How an attack unfolds

An attacker supplies a crafted multi-frame image whose first frame allocates a narrow buffer; later frames alter the logical mode and decoder tiles to wider data; load_prepare() reuses the undersized native storage, writing pixels beyond its bounds and potentially hijacking control flow on the MPO path under certain runtime conditions.

How to fix it

Upgrade Pillow to version 13.0.0 or later; rebuild and restart all dependent services; if immediate upgrade is impossible, disable processing of PSD, MPO, DCX, and MIC formats or add strict input validation and sandboxing around image loaders.

How to confirm the fix worked

Confirm installed Pillow version is 13.0.0+ via pip show or import; run the library's regression tests plus crafted multi-frame images that previously triggered the mode-transition bug; monitor for absence of crashes or memory errors under those inputs.

Typical attack path

  1. Deliver a malicious multi-frame PSD/MPO/DCX/MIC file via upload, email attachment, or web fetch
  2. Trigger Pillow image loading in a vulnerable 11.0.0–12.x version
  3. Induce frame-mode transition that reuses the stale narrow ImagingCore allocation
  4. Achieve out-of-bounds native write (or over-read) leading to crash or, on MPO, possible command execution

How to detect it

Search application and system logs for segmentation faults, SIGSEGV, or Python tracebacks originating from Pillow's _imaging or ImageFile modules during multi-frame load operations; inspect for unexpected process crashes shortly after image upload or decode events.

What your security team should do

  • Immediately upgrade all Pillow installations to 13.0.0
  • Inventory and prioritize internet-facing or high-value services that accept user-supplied images
  • Add runtime guards or format filters until patching is complete
  • Update vulnerability scanners and SBOMs to reflect the new fixed version

The record

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the stale native storage because _im is non-null without verifying that its mode and size still match. Crafted PSD, MPO, DCX, or MIC frame transitions can then write wider pixels into the narrow allocation, causing native out-of-bounds writes and crashes. The MPO path can also cause a native over-read and, in demonstrated runtime-specific profiles, command execution. This issue is fixed in version 13.0.0.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities