Cloudanix VulnDB

CVE-2026-96643

Medium · 6.5

CVSS

6.5

EPSS

0.4%

Published

Oct 21, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in a popular Python library that handles photos can let someone send a specially made picture file that makes the computer work extremely hard and slow everything down.

Exploitation
Remote Unauthenticated
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Repeated slicing of EXIF data containing duplicate six-byte headers in Exif.load() combined with an uncapped PNG eXIf chunk produces quadratic CPU consumption during Image.getexif, Image._getexif, and ImageOps.exif_transpose processing.

Why it matters to the business

Attackers can trigger sustained high CPU usage on any system that processes untrusted images through common upload or rotation workflows, degrading service availability and increasing compute costs.

How an attack unfolds

An attacker supplies a specially crafted PNG containing many repeated EXIF headers; when the image is loaded via any of the affected EXIF entry points the library performs repeated shrinking copies, driving CPU utilization to 100 percent on a single core with a single file.

How to fix it

Upgrade Pillow to version 13.0.0 or later; until the upgrade can be applied, disable automatic EXIF-based rotation or reject PNG files containing eXIf chunks at the application or WAF layer.

How to confirm the fix worked

Confirm the installed Pillow version is 13.0.0 or newer; test with a minimal PNG containing repeated EXIF headers and verify that CPU time remains linear rather than quadratic.

Typical attack path

  1. Craft a PNG file whose eXIf chunk contains many concatenated six-byte Exif headers
  2. Deliver the file through any photo-upload, thumbnail, or rotation code path that calls getexif or exif_transpose
  3. Observe repeated header slicing inside Exif.load that copies the remaining buffer on each iteration
  4. Consume CPU resources until the process is terminated or the system becomes unresponsive

How to detect it

Review web-server and application logs for image-processing endpoints that show unusually long request durations or high CPU samples when handling PNG uploads; correlate with file-size versus processing-time anomalies.

What your security team should do

  • Prioritize upgrade of Pillow to 13.0.0 within the next maintenance window given the four-day publication window and stable but non-zero EPSS
  • Add PNG eXIf chunk size or header-count limits in image-ingestion services until the library is updated
  • Monitor CPU usage on image-processing workers for sudden sustained spikes correlated with PNG uploads

The record

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new shrinking copy on every iteration and quadratic CPU work. The condition is reachable through Image.getexif(), Image._getexif(), and ImageOps.exif_transpose(), including common photo-upload rotation workflows. This issue is fixed in version 13.0.0.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities