{"id":"ghsa-ghsa-9v9v-9qvf-h2hj","seq":309588,"kind":"advisory","title":"Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)","url":"https://github.com/advisories/GHSA-9v9v-9qvf-h2hj","permalink":"https://vulnpulse.app/items/ghsa-ghsa-9v9v-9qvf-h2hj","summary":"影響: pip:Pillow < 13.0.0 → 13.0.0\nOn Windows builds, Pillow stores EMF and WMF image dimensions without a range check and passes them to the native drawwmf handler. That code sizes its allocation from dimensions truncated into 16-bit header fields but copies the result using the full 32-bit dimensions. A crafted metafile that is wide and short passes the decompression-bomb pixel check yet causes a heap over-read. Details The EMF branch computes the size straight from signed 32-bit header fields and stores it with no positivity…","severity":"high","techs":["python"],"cves":["CVE-2026-96644"],"tags":["GHSA-9v9v-9qvf-h2hj","Pillow"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:03:14.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}