CVE-2026-96638

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining destlength without a per-branch cap. A delta can add roughly 255 image rows in one iteration, ...

CVE-2026-96638 Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining destlength without a per-branch cap. A delta can add roughly 255 image rows in one iteration, ...

CVE-2026-96638

The Pillow Python imaging library (versions 9.1.0 through 13.0.0 ) is vulnerable to a memory-exhaustion denial of service due to a flaw in the BmpRleDecoder.decode() function located in src/PIL/BmpImagePlugin.py. The root cause is the lack of a per-branch cap on crafted RLE BMP delta escapes and ...

EUVD-2026-107559

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining destlength without a per-branch cap. A delta can add roughly 255 image rows in one iteration, ...