CVE-2026-112397

The Pillow Python imaging library is vulnerable to an out-of-bounds access in the ImageMorph.MorphOp.apply() function. The root cause is that the native morphology routine indexes outrow[width - 1] without validating geometry, allowing PPM and PGM inputs with a width of zero to trigger an out-of-...

CVE-2026-96644

The Pillow Python imaging library is vulnerable to a heap over-read on Windows systems prior to version 13.0.0 . The issue occurs because src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. This handler incorrectly sizes a DIB al...

CVE-2026-112394

The Pillow Python imaging library versions prior to 13.0.0 are vulnerable to a buffer over-read in the P;2L and P;4L raw decoders. The root cause is that ImagingRawDecode calculates a packed-pixel row size while the unpackers read separately padded bit planes, allowing a caller to supply dimensio...

CVE-2026-112402

The Pillow Python imaging library contains a double-free vulnerability in the ImagingScaleAffine component. When performing Image.transform() operations (specifically Transform.EXTENT or pure scale-and-translate Transform.AFFINE with NEAREST resampling) under memory pressure, a selective allocati...

CVE-2026-96636

The Pillow Python imaging library is vulnerable to a memory-exhaustion denial of service in versions prior to 13.0.0 . The root cause is that MpoImageFile.seek() and DcxImageFile.seek() reparse subsequent MPO or DCX frames and update self._size without re-executing the Image._decompression_bomb_c...

CVE-2026-96642

The Pillow Python imaging library is vulnerable to an infinite CPU-spin loop in the TarIO initializer (located in src/PIL/TarIO.py) in versions prior to 13.0.0 . The root cause is the acceptance of a negative octal member size , which triggers a backward seek that returns to the same 512-byte hea...

CVE-2026-96637

The Pillow Python imaging library is vulnerable to an unbounded memory allocation issue in versions prior to 13.0.0 . The root cause is located in SpiderImageFile.seek() within src/PIL/SpiderImagePlugin.py, which reparses a later SPIDER stack frame and replaces self._size without re-executing the...

CVE-2026-96641

The Pillow Python imaging library is vulnerable to a signed C integer overflow in src/_imaging.c prior to version 13.0.0 . The PILfont text-width accumulation logic fails to check negative glyph advances against INT_MIN, allowing repeated 16-bit advances of -32768 to result in a large positive wi...