Pillow: Memory corruption via stale image storage in multi-frame loaders
Summary
Pillow, the Python imaging library, can reuse stale native image memory when processing multi-frame PSD, MPO, DCX or MIC files whose frame mode changes between frames. A crafted image file can cause out-of-bounds writes and over-reads, leading to crashes and, in specific runtime configurations, possible command execution. The attack requires only a crafted image and no authentication or user interaction, so exposed upload services that process images with Pillow are at particular risk.
Affected
- Pillow 11.0.0 up to and including 12.x (advisory range: >= 11.0.0, < 13.0.0)
Fixed in
- Pillow 13.0.0
Workaround
- Unknown. No vendor workaround was found; upgrading to 13.0.0 is the only remedy in the sources.
- Until patched, do not process untrusted PSD, MPO, DCX or MIC files with Pillow.
Exploitation
- CISA KEV: not listed. EPSS about 1%.
- Exploited in the wild: none reported.
- The advisory author demonstrated crashes, memory corruption and an over-read, and command execution only in specific runtime profiles; universal RCE is not claimed.
- Public proof of concept: unknown.
Our recommendation
- Upgrade Pillow to 13.0.0 or later; note that Pillow 13 requires Python 3.11 or newer.
- Check requirements files, lock files and container images for transitive Pillow dependencies and rebuild affected images.
- Restrict or isolate image processing of untrusted uploads until patched.
- Prioritise internet-facing and upload-handling systems; monitor for crashes of image-processing services.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-v9pv-5gc8-w2m6 github.com
- Fix commit 78d97d9 (PR #10105) github.com
- Pillow 13.0.0 release github.com
- Pillow 13.0.0 release notes pillow.readthedocs.io
- Rapid7 vulnerability entry www.rapid7.com
- Vulners CVE-2026-96639 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:04.
Original description (NVD)
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the stale native storage because _im is non-null without verifying that its mode and size still match. Crafted PSD, MPO, DCX, or MIC frame transitions can then write wider pixels into the narrow allocation, causing native out-of-bounds writes and crashes. The MPO path can also cause a native over-read and, in demonstrated runtime-specific profiles, command execution. This issue is fixed in version 13.0.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.