DEBIAN-CVE-2026-96643

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-96643
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-96643.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-96643
Upstream
Published
2026-10-22T09:47:25Z
Modified
2026-10-22T10:01:02Z
Summary
[none]
Details

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new shrinking copy on every iteration and quadratic CPU work. The condition is reachable through Image.getexif(), Image._getexif(), and ImageOps.exif_transpose(), including common photo-upload rotation workflows. This issue is fixed in version 13.0.0.

References

Affected packages

Debian:12 / pillow

Package

Name
pillow
Purl
pkg:deb/debian/pillow?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

9.*
9.4.0-1.1
9.4.0-1.1+deb12u1
9.5.0-1
10.*
10.0.0-1
10.1.0-1
10.2.0-1
10.3.0-1
10.3.0-2
10.4.0-1
10.4.0-1.1
11.*
11.1.0-1
11.1.0-2
11.1.0-3
11.1.0-4
11.1.0-5
11.2.1-1
11.3.0-1
12.*
12.0.0-1
12.1.0-1
12.1.1-1
12.1.1-2
12.2.0-1
12.3.0-1
13.*
13.0.0-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-96643.json"

Debian:13 / pillow

Package

Name
pillow
Purl
pkg:deb/debian/pillow?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

11.*
11.1.0-5
11.1.0-5+deb13u1
11.1.0-5+deb13u2
11.1.0-5+deb13u3
11.1.0-5+deb13u4
11.2.1-1
11.3.0-1
12.*
12.0.0-1
12.1.0-1
12.1.1-1
12.1.1-2
12.2.0-1
12.3.0-1
13.*
13.0.0-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-96643.json"

Debian:14 / pillow

Package

Name
pillow
Purl
pkg:deb/debian/pillow?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

11.*
11.1.0-5
11.2.1-1
11.3.0-1
12.*
12.0.0-1
12.1.0-1
12.1.1-1
12.1.1-2
12.2.0-1
12.3.0-1
13.*
13.0.0-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-96643.json"