pillow: pillow: Denial of Service via crafted multi-frame image conversion

A flaw was found in Pillow. When converting multi-frame images into a multi-page PDF document, the library repeatedly scans previously assigned object identifiers, resulting in quadratic processing time. A remote attacker could exploit this vulnerability by supplying a crafted image with a large...

pillow: pillow: Denial of Service via crafted multi-frame image conversion

A flaw was found in Pillow. When converting multi-frame images into a multi-page PDF document, the library repeatedly scans previously assigned object identifiers, resulting in quadratic processing time. A remote attacker could exploit this vulnerability by supplying a crafted image with a large...

BIT-PILLOW-2026-96639 Pillow multi-frame loaders can reuse stale native image storage after mode transitions

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.loadprepare reuses the...

Pillow Multi-frame Loaders Can Reuse Stale Native Image Storage After Mode Transitions

Summary Pillow multi-frame image loaders can retain native "ImagingCore" storage allocated for one frame while changing the Python-side image "mode" and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as "L", and a later frame of the same dimensions switches t...

SUSE CVE-2026-96639

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.loadprepare reuses the...

GHSA-V9PV-5GC8-W2M6 Pillow multi-frame loaders can reuse stale native image storage after mode transitions

Summary Pillow multi-frame image loaders can retain native ImagingCore storage allocated for one frame while changing the Python-side image mode and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as L, and a later frame of the same dimensions switches to a...

Pillow multi-frame loaders can reuse stale native image storage after mode transitions

Summary Pillow multi-frame image loaders can retain native ImagingCore storage allocated for one frame while changing the Python-side image mode and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as L, and a later frame of the same dimensions switches to a...

EUVD-2026-107573

Pillow multi-frame loaders can reuse stale native image storage after mode transitions...

Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

Summary Pillow's decompression-bomb protection Image.decompressionbombcheck, gated by Image.MAXIMAGEPIXELS is enforced only on the first frame, inside Image.open. For multi-frame formats, seek re-parses the target frame's header and resets self.size. GifImagePlugin and TiffImagePlugin re-run the...

CVE-2026-96636

A flaw was found in Pillow. A remote attacker could exploit this vulnerability by enticing an application or user to process a specially crafted multi-frame image file. Because decompression bomb protections are bypassed when navigating subsequent image frames, decoding the file allocates excessi...

Linux Distros Unpatched Vulnerability : CVE-2026-96639

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a...

CVE-2026-96637

A flaw was found in Pillow. When processing multi-frame SPIDER images, decompression bomb safeguards are not reapplied when navigating to subsequent frames that declare excessively large dimensions. A remote attacker could exploit this vulnerability by providing a specially crafted image file,...

PYSEC-2026-4339

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.loadprepare reuses the...

DEBIAN-CVE-2026-96639

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.loadprepare reuses the...

PYSEC-2026-4339

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.loadprepare reuses the...

CVE-2026-96639

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.loadprepare reuses the...

CVE-2026-96639

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.loadprepare reuses the...

CVE-2026-96639

The Pillow Python imaging library (versions 11.0.0 through 13.0.0 ) is vulnerable to out-of-bounds memory operations in multi-frame loaders. The root cause is that ImageFile.load_prepare() reuses stale native storage from a narrow frame mode without verifying if the subsequent frame's mode and si...

CVE-2026-96639 Pillow multi-frame loaders can reuse stale native image storage after mode transitions

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.loadprepare reuses the...

CVE-2026-96639

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.loadprepare reuses the...