Heap Memory Vulnerability in Pillow Imaging Library Affects Python Applications

CVE-2026-96778

What is CVE-2026-96778?

The Pillow imaging library, utilized for image processing in Python, contains a vulnerability that allows for heap memory corruption. Specifically, during the handling of JPEG images with ICC profiles, an attacker can exploit a flaw in the ImagingJpegEncode function. This occurs when the encoder buffer is filled to its limit, causing the free_in_buffer counter to wrap improperly. As a result, a crafted JPEG comment could overwrite adjacent heap memory, potentially leading to application crashes or arbitrary code execution. Users are strongly advised to upgrade to version 13.0.0 or later to mitigate this risk.

References