Buffer Overflow Risk in Pillow Library Affects Image Processing on Windows
CVE-2026-96644
7.1HIGH
What is CVE-2026-96644?
The Pillow library, widely used for image processing in Python, contains a vulnerability that arises from the way it handles Windows Metafile (WMF) and Enhanced Metafile (EMF) dimensions. In versions prior to 13.0.0, unchecked 32-bit dimensions are passed to a native drawing handler, which may lead to a buffer overflow condition when rendering maliciously crafted metafiles. This flaw allows for potential memory disclosure or crashes, posing risks to users of the library on Windows systems. The issue has been addressed in version 13.0.0, emphasizing the importance of keeping software updated to mitigate vulnerabilities.
Affected Version(s)
Pillow < 13.0.0