CVE-2026-96778

Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode in src/libImaging/JpegEncode.c can call jpegwritemarker for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted freeinbuffer...

CVE-2026-96778 Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer

Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode in src/libImaging/JpegEncode.c can call jpegwritemarker for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted freeinbuffer...

CVE-2026-96778

The Pillow Python imaging library (versions 9.4.0 through 13.0.0 ) contains a heap buffer overflow in src/libImaging/JpegEncode.c. The ImagingJpegEncode() function can call jpeg_write_marker() for a JPEG COM comment when an ICC profile exactly fills the 65536-byte encoder buffer. Due to libjpeg w...

EUVD-2026-107566

Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode in src/libImaging/JpegEncode.c can call jpegwritemarker for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted freeinbuffer...