# CVE-2026-96639: Pillow multi-frame loaders can reuse stale native image storage after mode transitions

- Exploited (CISA KEV): no
- Published: 2026-10-21
- CVSS: 9.8 CRITICAL (v3.1)
- EPSS: 0.7% (52th percentile)
- CWE: CWE-125, CWE-787

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the stale native storage because _im is non-null without verifying that its mode and size still match. Crafted PSD, MPO, DCX, or MIC frame transitions can then write wider pixels into the narrow allocation, causing native out-of-bounds writes and crashes. The MPO path can also cause a native over-read and, in demonstrated runtime-specific profiles, command execution. This issue is fixed in version 13.0.0.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

2 posts seen since 2026-11-02.

- x 2026-11-02: Pillow CVE-2026-96639 (CVSS 9.8): Betrifft dich das? JA, wenn deine Python-App Bilder von Nutzern öffnet. Betroffen: 11.0.0 bis 12.3.0. Fix: 13.0.0 (Python 3.11+). Prüfen: pip show pillow Video und Stimme: KI-generiert. https://t.co/cSxJ259tSx https://t.co/l7ivpHG4ka (https://x.com/stackwatch_de/status/2117357225568006408)
- bluesky 2026-11-02: Pillow CVE-2026-96639 (CVSS 9.8): JA, wenn deine Python-App Bilder von Nutzern öffnet. Betroffen 11.0.0 bis 12.3.0, Fix 13.0.0 (Python 3.11+). Prüfen: pip show pillow Video und Stimme: KI-generiert. stackwatch.de?utm_source=bluesky&utm_medium=social&utm_campaign=pillow-cve-2026-… (https://bsky.app/profile/stackwatch.de/post/3mze6tidgdk2q)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-96639 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-96639