CVE-2026-96638: Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining destlength without a per-branch cap. A delta can add roughly 255 image rows in one iteration, so a kilobyte-sized file with a large but permitted width can expand the data bytearray to hundreds of megabytes or more, causing memory-exhaustion denial of service. This issue is fixed in version 13.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pillowto a version that resolves this vulnerability.Fixed in 13.0.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Pillow versions from 9.1.0 up to, but not including, 13.0.0 are affected when they decode attacker-controlled RLE-compressed BMP files.
What does an attacker need to exploit this issue?
An attacker needs to provide a crafted RLE BMP file for the application to decode. No authentication or special privileges are required, but user interaction is required according to the supplied severity vector.
What is the impact of successful exploitation?
A small crafted file can cause Pillow to grow an in-memory bytearray to hundreds of megabytes or more, potentially exhausting memory and causing a denial of service. The provided impact assessment indicates no confidentiality or integrity impact.
What should be done if an immediate upgrade is not possible?
Avoid decoding untrusted RLE-compressed BMP files until Pillow can be updated. The issue is fixed in Pillow 13.0.0.