{"id":"ghsa-ghsa-4rm8-3hmm-39fg","seq":309591,"kind":"advisory","title":"Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise","url":"https://github.com/advisories/GHSA-4rm8-3hmm-39fg","permalink":"https://vulnpulse.app/items/ghsa-ghsa-4rm8-3hmm-39fg","summary":"影響: pip:pillow < 13.0.0 → 13.0.0\nAffected Object and Source Package: Pillow 12.3.0 Source: PyPI sdist pillow-12.3.0.tar.gz SHA-256: 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce Sink: src/_imaging.c:2809:15, xsize += dx Details The code in Pillow 12.3.0 is: c for (xsize = 0; text; text++) { int dx = self->glyphs[text].dx; if (dx > 0 && xsize > INT_MAX - dx) { PyErr_SetString(PyExc_OverflowError, \"Width too large\"); return -1; } xsize += dx; } The PILfont glyph advance is parsed from a signed 16-bit field, so…","severity":"medium","techs":["python"],"cves":["CVE-2026-96641"],"tags":["GHSA-4rm8-3hmm-39fg","pillow"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:01:14.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}