Pillow: Heap over-read in WMF/EMF rendering (CVE-2026-96644)

Pillow versions prior to 13.0.0 contain a heap over-read vulnerability in its Windows-specific drawwmf native handler. The vulnerability arises when processing WMF or EMF files where image dimensions (stored in 32-bit header fields) are truncated to 16-bit values during the memory allocation phase of rendering, while the subsequent memory copy operation uses the original 32-bit dimensions. An attacker can provide a crafted file that bypasses standard pixel-count decompression-bomb checks by setting a large width and small height, leading to a heap over-read which can result in process crashes or information disclosure. This issue only affects Windows builds where the native handler is compiled.

Impact

Successful exploitation allows for reading out-of-bounds heap memory, which can lead to application termination (DoS) or the potential leakage of sensitive data stored in memory adjacent to the heap buffer.

Recommendation

Update the Pillow library to version 13.0.0 or later across all Windows-based environments where it is utilized.