413510 matches found
CVE-2026-114501
The Pillow Python imaging library (versions 11.2.1 through 13.0.0 ) contains a memory disclosure vulnerability during Arrow export . When PIOLLOW_ALIGNMENT is greater than 1, the library incorrectly assumes rows are tightly contiguous, exporting from an offset that may include uninitialized paddi...
CVE-2026-114501 Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...
Use of Uninitialized Resource
Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource via the Arrow array export functions exportsinglechannelarray and exportfixedpixelarray in src/libImaging/Arrow.c when exporting non-contiguous images. When image rows are not stored contiguously in memory ...
CVE-2026-114501 Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...
CVE-2026-114501 Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...
CVE-2026-98652
A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM subsystem for the s390 architecture. A missing synchronization lock during status storing operations allows a local user with virtual machine management privileges to trigger a race condition. This flaw can lead to kernel...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
php-74-exposure-lab A reproducible lab for answering one ques...
Pillow: MSP RLE decoder expands a tiny file into unbounded memory
Summary The MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels. Details The MSP decoder writes each run...
GHSA-GG2R-WVFM-Q9RX Pillow: MSP RLE decoder expands a tiny file into unbounded memory
Summary The MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels. Details The MSP decoder writes each run...
EUVD-2026-104650
Pillow: MSP RLE decoder expands a tiny file into unbounded memory...
CVE-2026-96636 Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without rerunning Image.decompressionbombcheck. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an over-lim...
CVE-2026-96636 Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without rerunning Image.decompressionbombcheck. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an over-lim...
CVE-2026-96636 Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without rerunning Image.decompressionbombcheck. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an over-lim...
CVE-2026-96636
The Pillow Python imaging library is vulnerable to a memory-exhaustion denial of service in versions prior to 13.0.0 . The root cause is that MpoImageFile.seek() and DcxImageFile.seek() reparse subsequent MPO or DCX frames and update self._size without re-executing the Image._decompression_bomb_c...
CVE-2026-96636
Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without rerunning Image.decompressionbombcheck. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an over-lim...
CVE-2026-96636
Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without rerunning Image.decompressionbombcheck. A crafted multi-frame image can use a tiny first frame to pass Image.open and then declare an over-lim...
Improper Handling of Highly Compressed Data (Data Amplification)
Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the seek method in src/PIL/SpiderImagePlugin.py, which lacks a decompression bomb check after seeking to a new frame in a SPIDER format image. An attacker can supply a...
CVE-2026-96637
Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self.size without rerunning Image.decompressionbombcheck. A tiny file can use a safe first frame to pass Image.open and then declare very larg...
CVE-2026-96637
Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self.size without rerunning Image.decompressionbombcheck. A tiny file can use a safe first frame to pass Image.open and then declare very larg...