{"basis":"claimed","id":"CVE-2026-96639","name":"Pillow multi-frame loaders can reuse stale native image storage after mode transitions","vendorProject":"python-pillow","product":"Pillow","publishedAt":"2026-10-21","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"exploited":null,"epss":{"score":0.00659,"percentile":0.51526,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"none","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"none","firstOn":null,"daysToRule":null},"f5":{"status":"none","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"Pillow multi-frame loaders can reuse stale native image storage after mode transitions","description":"Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the stale native storage because _im is non-null without verifying that its mode and size still match. Crafted PSD, MPO, DCX, or MIC frame transitions can then write wider pixels into the narrow allocation, causing native out-of-bounds writes and crashes. The MPO path can also cause a native over-read and, in demonstrated runtime-specific profiles, command execution. This issue is fixed in version 13.0.0.","cwes":["CWE-125","CWE-787"],"vendors":[{"vendor":"cloudflare","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T21:17:16.933Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total"},"measured":[],"social":{"total":2,"first_seen":"2026-11-02T20:43:31.102Z","daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":2}],"top_posts":[{"source":"x","kind":"post","url":"https://x.com/stackwatch_de/status/2117357225568006408","author":"stackwatch_de","author_name":"Stackwatch","avatar_url":"https://pbs.twimg.com/profile_images/2113691435572629504/JdYYYPnF_bigger.png","text":"Pillow CVE-2026-96639 (CVSS 9.8): Betrifft dich das? JA, wenn deine Python-App Bilder von Nutzern öffnet.\nBetroffen: 11.0.0 bis 12.3.0. Fix: 13.0.0 (Python 3.11+). Prüfen: pip show pillow\nVideo und Stimme: KI-generiert.\nhttps://t.co/cSxJ259tSx https://t.co/l7ivpHG4ka","engagement":0,"posted_at":"2026-11-02T20:44:35.000Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/stackwatch.de/post/3mze6tidgdk2q","author":"stackwatch.de","author_name":"Stackwatch","avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:4v3yafsxyvz6e3tj6cexnult/bafkreia5a2tccrx6tz5nnlowudrjot7zv2xepxjlgcrmu6ablk33r2xx2q","text":"Pillow CVE-2026-96639 (CVSS 9.8): JA, wenn deine Python-App Bilder von Nutzern öffnet. Betroffen 11.0.0 bis 12.3.0, Fix 13.0.0 (Python 3.11+). Prüfen: pip show pillow\nVideo und Stimme: KI-generiert.\nstackwatch.de?utm_source=bluesky&utm_medium=social&utm_campaign=pillow-cve-2026-…","engagement":0,"posted_at":"2026-11-02T20:43:31.102Z"}],"exploit_repositories":[]}}