BIT-pillow-2026-96639

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/pillow/BIT-pillow-2026-96639.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-pillow-2026-96639
Aliases
Published
2026-10-29T08:58:14Z
Modified
2026-10-29T10:55:37Z
Summary
Pillow multi-frame loaders can reuse stale native image storage after mode transitions
Details

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the stale native storage because _im is non-null without verifying that its mode and size still match. Crafted PSD, MPO, DCX, or MIC frame transitions can then write wider pixels into the narrow allocation, causing native out-of-bounds writes and crashes. The MPO path can also cause a native over-read and, in demonstrated runtime-specific profiles, command execution. This issue is fixed in version 13.0.0.

Database specific 
{
    "cpes":  [
        "cpe:2.3:a:python:pillow:*:*:*:*:*:python:*:*"
    ],
    "severity":  "Critical"
}
References

Affected packages

Bitnami / pillow

Package

Name
pillow
Purl
pkg:bitnami/pillow

Severity

  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
11.0.0
Fixed
13.0.0

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/pillow/BIT-pillow-2026-96639.json"