Denial of Service Vulnerability in Pillow Python Imaging Library
CVE-2026-96643
7.1HIGH
What is CVE-2026-96643?
The Pillow Python imaging library, versions 11.0.0 through 13.0.0, contains a vulnerability in the handling of EXIF metadata. Specifically, the Exif.load() function improperly processes data, leading to excessive CPU usage during operations like Image.getexif() or ImageOps.exif_transpose(). This occurs as the library repeatedly slices the EXIF data, creating performance issues through a quadratic workload, especially exploitable via photo-upload functionalities. Users are advised to update to version 13.0.0 or later to mitigate this vulnerability.
Affected Version(s)
Pillow >= 11.0.0, < 13.0.0