Memory Exhaustion Vulnerability in Pillow Python Imaging Library
CVE-2026-96636

6.5MEDIUM

Key Information:

Vendor

Python-pillow

Status
Pillow
Vendor
CVE Published:
21 October 2026

What is CVE-2026-96636?

The Pillow library, utilized for image processing in Python, contains a vulnerability where the seek() method in MpoImageFile and DcxImageFile can cause significant memory exhaustion. By crafting multi-frame images with a minimal initial frame, attackers can exploit this flaw to bypass the Image.open() method, eventually leading to severe memory consumption during frame decoding, which can overwhelm the system resources. This issue has been resolved in version 13.0.0, which implements checks to prevent this exploitation.

Affected Version(s)

Pillow < 13.0.0

References

https://github.com/python-pillow/Pillow/security/advisori...
x_refsource_CONFIRM
https://github.com/python-pillow/Pillow/pull/10011
x_refsource_MISC
https://github.com/python-pillow/Pillow/commit/f1acfc54c5...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.