CVE-2026-96637

Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self.size without rerunning Image.decompressionbombcheck. A tiny file can use a safe first frame to pass Image.open and then declare very larg...

CVE-2026-96640

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

CVE-2026-114143

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign, deepRef, and setNestedKey. The resultin...

GHSA-5XM2-6676-QCP9 Pillow: APNG background disposal allocates full canvas before decompression bomb check

============================================================================ APNG background disposal allocates full canvas before decompression bomb check Location: src/PIL/PngImagePlugin.py:1000 in PngImageFile.seek Commit: a707c6b21c313880d0771e54965d142dd42358b6...

Pillow: APNG background disposal allocates full canvas before decompression bomb check

============================================================================ APNG background disposal allocates full canvas before decompression bomb check Location: src/PIL/PngImagePlugin.py:1000 in PngImageFile.seek Commit: a707c6b21c313880d0771e54965d142dd42358b6...

EUVD-2026-104635

Pillow: APNG background disposal allocates full canvas before decompression bomb check...

CVE-2026-113811

Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search. The failure shift is cached for each pair of trie state and text character in a field of the matcher object, and nothing clears it. A character not seen...

CVE-2026-114501

The Pillow Python imaging library (versions 11.2.1 through 13.0.0 ) contains a memory disclosure vulnerability during Arrow export . When PIOLLOW_ALIGNMENT is greater than 1, the library incorrectly assumes rows are tightly contiguous, exporting from an offset that may include uninitialized paddi...

CVE-2026-114501 Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...

Use of Uninitialized Resource

Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource via the Arrow array export functions exportsinglechannelarray and exportfixedpixelarray in src/libImaging/Arrow.c when exporting non-contiguous images. When image rows are not stored contiguously in memory ...

CVE-2026-114501 Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...

CVE-2026-114501 Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...

CVE-2026-98652

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM subsystem for the s390 architecture. A missing synchronization lock during status storing operations allows a local user with virtual machine management privileges to trigger a race condition. This flaw can lead to kernel...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php-74-exposure-lab A reproducible lab for answering one ques...

Pillow: MSP RLE decoder expands a tiny file into unbounded memory

Summary The MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels. Details The MSP decoder writes each run...

GHSA-GG2R-WVFM-Q9RX Pillow: MSP RLE decoder expands a tiny file into unbounded memory

Summary The MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels. Details The MSP decoder writes each run...

EUVD-2026-104650

Pillow: MSP RLE decoder expands a tiny file into unbounded memory...

CVE-2026-96636 Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without rerunning Image.decompressionbombcheck. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an over-lim...

CVE-2026-96636 Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without rerunning Image.decompressionbombcheck. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an over-lim...

CVE-2026-96636

The Pillow Python imaging library is vulnerable to a memory-exhaustion denial of service in versions prior to 13.0.0 . The root cause is that MpoImageFile.seek() and DcxImageFile.seek() reparse subsequent MPO or DCX frames and update self._size without re-executing the Image._decompression_bomb_c...