Memory Exhaustion Vulnerability in Pillow Python Imaging Library
CVE-2026-96638

6.5MEDIUM

Key Information:

Vendor

Python-pillow

Status
Pillow
Vendor
CVE Published:
21 October 2026

What is CVE-2026-96638?

The Pillow Python imaging library has a vulnerability in the BmpRleDecoder.decode() method, which may allow crafted RLE BMP files to exceed intended memory limits. Specifically, versions from 9.1.0 to 13.0.0 could be exploited via crafted delta escapes and absolute-mode runs, allowing attackers to cause significant memory exhaustion and potentially trigger denial of service. This vulnerability can lead to an application consuming excessive memory resources, with the potential to slow down or crash the service. The issue has been resolved in version 13.0.0.

Affected Version(s)

Pillow >= 9.1.0, < 13.0.0

References

https://github.com/python-pillow/Pillow/security/advisori...
x_refsource_CONFIRM
https://github.com/python-pillow/Pillow/pull/10015
x_refsource_MISC
https://github.com/python-pillow/Pillow/commit/e7794835e3...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.