BIT-PILLOW-2026-96636 Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without rerunning Image.decompressionbombcheck. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an over-lim...

Pillow: Decompression-bomb Protection Bypass Via Multi-frame Seek() In MPO And DCX (MpoImageFile.seek / DcxImageFile.see

Summary Pillow's decompression-bomb protection "Image.decompressionbombcheck", gated by "Image.MAXIMAGEPIXELS" is enforced only on the first frame, inside "Image.open". For multi-frame formats, "seek" re-parses the target frame's header and resets "self.size". "GifImagePlugin" and "TiffImagePlugi...

SUSE CVE-2026-96636

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without rerunning Image.decompressionbombcheck. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an over-lim...

GHSA-P8HX-V2P6-RP84 Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

Summary Pillow's decompression-bomb protection Image.decompressionbombcheck, gated by Image.MAXIMAGEPIXELS is enforced only on the first frame, inside Image.open. For multi-frame formats, seek re-parses the target frame's header and resets self.size. GifImagePlugin and TiffImagePlugin re-run the...

EUVD-2026-107572

Pillow: Decompression-bomb protection bypass via multi-frame seek in MPO and DCX MpoImageFile.seek / DcxImageFile.seek...

Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

Summary Pillow's decompression-bomb protection Image.decompressionbombcheck, gated by Image.MAXIMAGEPIXELS is enforced only on the first frame, inside Image.open. For multi-frame formats, seek re-parses the target frame's header and resets self.size. GifImagePlugin and TiffImagePlugin re-run the...

Linux Distros Unpatched Vulnerability : CVE-2026-96636

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without...

DEBIAN-CVE-2026-96636

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without rerunning Image.decompressionbombcheck. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an over-lim...

PYSEC-2026-4337

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without rerunning Image.decompressionbombcheck. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an over-lim...

PYSEC-2026-4337

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without rerunning Image.decompressionbombcheck. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an over-lim...

CVE-2026-96636

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without rerunning Image.decompressionbombcheck. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an over-lim...

CVE-2026-96636 Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without rerunning Image.decompressionbombcheck. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an over-lim...

CVE-2026-96636 Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without rerunning Image.decompressionbombcheck. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an over-lim...

CVE-2026-96636

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without rerunning Image.decompressionbombcheck. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an over-lim...

CVE-2026-96636

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without rerunning Image.decompressionbombcheck. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an over-lim...

CVE-2026-96636

The Pillow Python imaging library is vulnerable to a memory-exhaustion denial of service in versions prior to 13.0.0 . The root cause is that MpoImageFile.seek() and DcxImageFile.seek() reparse subsequent MPO or DCX frames and update self._size without re-executing the Image._decompression_bomb_c...

Red Hat: CVE-2026-96636: pillow: pillow: Denial of Service via decompression bomb check bypass in multi-frame images

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without rerunning Image.decompressionbombcheck. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an over-lim...

PT-2026-129109

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self. size without rerunning Image. decompression bomb check. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an...

PT-2026-120831

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description In the Pillow Python imaging library, the MpoImageFile.seek and DcxImageFile.seek functions reparse subsequent MPO or DCX frames and update the self. size variable without re-executing the Image...

Pillow resource management error vulnerability

Versions of Pillow prior to 13.0.0 contain a resource management error vulnerability. This vulnerability arises because MpoImageFile.seek and DcxImageFile.seek replace self.size when re-parsing subsequent MPO or DCX frames, without re-running Image.decompressionbombcheck. specially crafted...