{"id":"ghsa-ghsa-24rc-8hj2-v98c","seq":309594,"kind":"advisory","title":"Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode","url":"https://github.com/advisories/GHSA-24rc-8hj2-v98c","permalink":"https://vulnpulse.app/items/ghsa-ghsa-24rc-8hj2-v98c","summary":"影響: pip:pillow >= 9.1.0, < 13.0.0 → 13.0.0\nBmpRleDecoder can be forced to allocate gigabytes of memory from a kilobyte-sized crafted BMP file via unbounded growth in the delta escape and absolute mode branches. Affected versions All versions up to and including current HEAD (v13.0.0.dev0, commit e7a7ea84) Root cause BmpRleDecoder.decode() (BmpImagePlugin.py:327-395) builds a Python bytearray data with dest_length = xsizeysize, looping while len(data) up to ~255xsize bytes in ONE iteration. - absolute mode (line 385): data += bytes_read…","severity":"medium","techs":["python"],"cves":["CVE-2026-96638"],"tags":["GHSA-24rc-8hj2-v98c","pillow"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T15:59:35.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}