SUSE CVE-2026-96637

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self.size without rerunning Image.decompressionbombcheck. A tiny file can use a safe first frame to pass Image.open and then declare very larg...

EUVD-2026-107569

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek leads to unbounded allocation DoS...

DEBIAN-CVE-2026-96637

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self.size without rerunning Image.decompressionbombcheck. A tiny file can use a safe first frame to pass Image.open and then declare very larg...

PYSEC-2026-4338

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self.size without rerunning Image.decompressionbombcheck. A tiny file can use a safe first frame to pass Image.open and then declare very larg...

CVE-2026-96637

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self.size without rerunning Image.decompressionbombcheck. A tiny file can use a safe first frame to pass Image.open and then declare very larg...

CVE-2026-96637

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self.size without rerunning Image.decompressionbombcheck. A tiny file can use a safe first frame to pass Image.open and then declare very larg...

CVE-2026-96637

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self.size without rerunning Image.decompressionbombcheck. A tiny file can use a safe first frame to pass Image.open and then declare very larg...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the seek method in src/PIL/SpiderImagePlugin.py, which lacks a decompression bomb check after seeking to a new frame in a SPIDER format image. An attacker can supply a...

PT-2026-129110

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self. size without rerunning Image. decompression bomb check. A tiny file can use a safe first frame to pass Image.open and then declare very...

Red Hat: CVE-2026-96637: pillow: pillow: Denial of Service via decompression bomb bypass in SPIDER images

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self.size without rerunning Image.decompressionbombcheck. A tiny file can use a safe first frame to pass Image.open and then declare very larg...

PT-2026-120832

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description The SpiderImageFile.seek function in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self. size without rerunning the Image. decompression bomb check function. This allo...