BIT-PILLOW-2026-96639 Pillow multi-frame loaders can reuse stale native image storage after mode transitions

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.loadprepare reuses the...

Pillow Multi-frame Loaders Can Reuse Stale Native Image Storage After Mode Transitions

Summary Pillow multi-frame image loaders can retain native "ImagingCore" storage allocated for one frame while changing the Python-side image "mode" and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as "L", and a later frame of the same dimensions switches t...

GHSA-V9PV-5GC8-W2M6 Pillow multi-frame loaders can reuse stale native image storage after mode transitions

Summary Pillow multi-frame image loaders can retain native ImagingCore storage allocated for one frame while changing the Python-side image mode and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as L, and a later frame of the same dimensions switches to a...

CVE-2026-96639 Pillow multi-frame loaders can reuse stale native image storage after mode transitions

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.loadprepare reuses the...

CVE-2026-96639

The Pillow Python imaging library (versions 11.0.0 through 13.0.0 ) is vulnerable to out-of-bounds memory operations in multi-frame loaders. The root cause is that ImageFile.load_prepare() reuses stale native storage from a narrow frame mode without verifying if the subsequent frame's mode and si...

CVE-2026-96639 Pillow multi-frame loaders can reuse stale native image storage after mode transitions

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.loadprepare reuses the...