Memory Consumption Vulnerability in Pillow Python Imaging Library

CVE-2026-96637

What is CVE-2026-96637?

Pillow, a widely used Python imaging library, has a vulnerability in its SpiderImageFile.seek() method impacting versions before 13.0.0. This flaw arises when a crafted image file, using a safe initial frame, can hide its true size and then declare excessively large dimensions later. When this image is processed, it can allocate significant amounts of memory, potentially leading to denial of service as the memory consumption escalates to gigabytes. The issue is resolved in version 13.0.0, making it crucial for users to update to the latest version to mitigate such risks.

References