CVE-2026-96637

The Pillow Python imaging library is vulnerable to an unbounded memory allocation issue in versions prior to 13.0.0 . The root cause is located in SpiderImageFile.seek() within src/PIL/SpiderImagePlugin.py, which reparses a later SPIDER stack frame and replaces self._size without re-executing the...

CVE-2026-96637 Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self.size without rerunning Image.decompressionbombcheck. A tiny file can use a safe first frame to pass Image.open and then declare very larg...