Pillow: decompression bomb check bypass in SpiderImagePlugin.seek() enables multi-GB allocation DoS (CVE-2026-96637)
Severity: high · Patch status: patched · Since 2026-10-17 · CVE-2026-96637
Pillow's SpiderImagePlugin.seek() bypasses the decompression bomb check: seek() calls open() directly, which re-parses an attacker-controlled SPIDER header and reassigns image size without any bounds validation, so ImageFile.loadprepare() allocates memory at an unchecked size. A crafted SPIDER stack file under 1KB can cause ~6.4GB allocation (mode F, e.g. 40000x40000) on im.load(), enabling denial of service. Sibling multi-frame plugins (GIF, TIFF, ICNS, ICO) do re-check on alternate paths; SpiderImagePlugin did not. All versions before 13.0.0 are affected. Fixed in Pillow 13.0.0 (commit 7cb0e02). A public PoC exists; no in-the-wild exploitation reported. Credit: Yazan Balawneh, CyStack Security Team.
What to do
- Upgrade pillow to 13.0.0 or later wherever it is installed, especially in services that process untrusted image uploads
- Until upgraded, restrict or reject SPIDER-format images (.stk/.hdr) from untrusted sources, or run image processing with memory limits (ulimit, container memory caps)
- Audit dependency manifests and lockfiles for pillow < 13.0.0 and rebuild/redeploy affected images
- Monitor for memory-exhaustion/OOM events in image-processing workloads
Fixed versions
Sources
All live incidents on Threat Watch
