CVE-2026-96636: Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DCX frames and replace self.size without rerunning Image.decompressionbombcheck(). A crafted multi-frame image can use a tiny first frame to pass Image.open() and then declare an over-limit later frame. Normal frame iteration through seek(), load(), or ImageSequence.Iterator can decode that frame and commit hundreds of megabytes or more, causing memory-exhaustion denial of service. This issue is fixed in version 13.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pillowto a version that resolves this vulnerability.Fixed in 13.0.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Pillow before 13.0.0 are exposed if they open attacker-controlled MPO or DCX files and subsequently access later frames, including through seek(), load(), or ImageSequence.Iterator. Processing only the initial frame does not describe the vulnerable path.
What must an attacker provide to trigger the denial of service?
An attacker needs to supply a crafted multi-frame MPO or DCX image with a small initial frame and a later frame that declares dimensions beyond Pillow's decompression-bomb limit. Exploitation requires the application to process that later frame; no attacker privileges are required, but user interaction is indicated by the supplied severity vector.
What should be done if upgrading is not immediately possible?
Avoid processing untrusted MPO and DCX files beyond their first frame. In particular, do not iterate frames or call seek() on untrusted files until Pillow can be updated to version 13.0.0.
How can I determine whether my application is affected?
Check whether it uses Pillow versions earlier than 13.0.0 and accepts or processes MPO or DCX images from untrusted sources. Applications that iterate image frames, use ImageSequence.Iterator, or call seek() and load() on these formats are affected by the described bypass.