CVE-2026-96637: Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self.size without rerunning Image.decompressionbombcheck(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pillowto a version that resolves this vulnerability.Fixed in 13.0.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Pillow versions before 13.0.0 are exposed if they open or load attacker-controlled SPIDER stack files, particularly when processing later frames in the stack.
What does an attacker need to exploit it?
An attacker needs to provide a crafted SPIDER file with an initially safe frame that passes Image.open(), followed by a later mode F frame declaring very large dimensions. Loading that later frame can trigger multi-gigabyte memory consumption.
Is opening the file alone sufficient to trigger the allocation?
No. The crafted first frame is intended to pass Image.open(); the large allocation occurs when the later malicious frame is loaded after SpiderImageFile.seek() reparses it.
What is the remediation?
Upgrade Pillow to version 13.0.0, which fixes the missing decompression-bomb check when seeking to later SPIDER stack frames.