Pillow: Native out-of-bounds write via multi-frame image mode transition (CVE-2026-96639)

Pillow (versions 11.0.0 through 12.3.0) contains a vulnerability where multi-frame image loaders do not properly validate retained native ImagingCore storage when a frame transition changes the image mode or dimensions. If frame 0 allocates a narrow buffer (e.g., mode L) and a subsequent frame requires a wider mode (e.g., RGB, CMYK), the decoder may write data into the stale, undersized buffer. This results in native out-of-bounds memory corruption, potential application crashes, and arbitrary command execution.

Attack Chain

1. Attacker crafts a multi-frame image file (PSD, MPO, DCX, or MIC) containing at least two frames.
2. Frame 0 is set to a narrow pixel mode (e.g., L) to trigger allocation of native storage.
3. Frame 1 is crafted with a wider pixel mode (e.g., RGB or CMYK) and the same dimensions as Frame 0.
4. The victim application calls Image.open() on the crafted file.
5. The application iterates to the second frame using ImageSequence.Iterator.
6. The application invokes frame.load() on the second frame.
7. Pillow reuses the native storage buffer from Frame 0 without revalidating the mode/size requirements.
8. The decoder performs an out-of-bounds write to the native buffer, leading to memory corruption or code execution.

Impact

The vulnerability allows for denial-of-service via process crashes. In the MPO/JPEG path, exploitation can lead to native out-of-bounds writes and arbitrary command execution under the context of the user running the Python process. The attack is achievable via a single unauthenticated HTTP request in web applications that process uploaded images using affected Pillow versions.

Recommendation

• Update Pillow to version 13.0.0 or later immediately.
• Audit all internal and public-facing services for the use of PIL.Image and PIL.ImageSequence to process user-supplied image files.
• Implement strict input validation or file-type filtering for image uploads to block potentially malicious multi-frame formats if an immediate upgrade is not feasible.
• Restrict the execution environment of image processing services to minimize the impact of potential command execution (e.g., using containers with minimal privileges, no shells, and restricted file system access).