Pillow: multi-frame image loaders reuse stale native buffers after mode transitions, enabling OOB writes and RCE (CVE-2026-96639)
Severity: critical · Patch status: patched · Since 2026-10-22 · CVE-2026-96639
Pillow multi-frame image loaders (PSD, MPO/JPEG, DCX, MIC) can retain native ImagingCore storage allocated for one frame while a later frame changes the image mode and decoder tiles. ImageFile.loadprepare() only reallocates storage when im is None and does not verify the retained buffer matches the current mode/size, so a crafted file with frame 0 in a narrow mode (e.g. L) and frame 1 in a wider mode (RGB/CMYK) causes native out-of-bounds writes, crashes, and over-reads. The researcher demonstrated command execution via the documented ImageSequence.Iterator + frame.load() path, including a one-request unauthenticated web-upload exploit. All Pillow users processing untrusted images (web upload services especially) are affected. Fixed in Pillow 13.0.0, published 2026-10-22.
What to do
- Upgrade Pillow to 13.0.0 immediately, prioritising internet-facing services that process user-uploaded images
- If upgrade is not immediate, restrict or sandbox image processing of untrusted uploads (e.g. isolate in containers/worker processes with limited privileges)
- Block or reject multi-frame MPO/PSD/DCX/MIC uploads at ingestion until patched
- Audit image-processing pipelines for Pillow versions >= 11.0.0, < 13.0.0 and monitor for crash anomalies indicating exploitation attempts
Fixed versions
Sources
All live incidents on Threat Watch
