CVE-2026-96639: Pillow multi-frame loaders can reuse stale native image storage after mode transitions
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.loadprepare() reuses the stale native storage because im is non-null without verifying that its mode and size still match. Crafted PSD, MPO, DCX, or MIC frame transitions can then write wider pixels into the narrow allocation, causing native out-of-bounds writes and crashes. The MPO path can also cause a native over-read and, in demonstrated runtime-specific profiles, command execution. This issue is fixed in version 13.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pillowto a version that resolves this vulnerability.Fixed in 13.0.0
Event History
Frequently Asked Questions
Which deployments are affected?
Pillow versions from 11.0.0 up to, but not including, 13.0.0 are affected. Applications that process attacker-controlled or otherwise untrusted PSD, MPO, DCX, or MIC multi-frame image files are exposed.
What must an attacker provide to trigger the issue?
An attacker needs to supply a crafted multi-frame image containing same-dimension frame transitions from a narrow mode to wider RGB or CMYK data. No authentication or user interaction is required according to the supplied severity vector.
What is the likely impact?
Crafted files can cause native out-of-bounds writes and application crashes. The MPO path can also cause a native over-read and, in demonstrated runtime-specific profiles, command execution.
What should be done if patching cannot happen immediately?
Avoid processing untrusted PSD, MPO, DCX, and MIC multi-frame files until Pillow can be updated. The available fixed version is 13.0.0.
How can I determine whether an application is affected?
Check the Pillow version used by the application and whether it accepts or processes multi-frame PSD, MPO, DCX, or MIC images. Versions in the affected range that handle such files should be treated as vulnerable.