{"id":"ghsa-ghsa-v9pv-5gc8-w2m6","seq":309593,"kind":"advisory","title":"Pillow multi-frame loaders can reuse stale native image storage after mode transitions","url":"https://github.com/advisories/GHSA-v9pv-5gc8-w2m6","permalink":"https://vulnpulse.app/items/ghsa-ghsa-v9pv-5gc8-w2m6","summary":"影響: pip:Pillow >= 11.0.0, < 13.0.0 → 13.0.0\nPillow multi-frame image loaders can retain native ImagingCore storage allocated for one frame while changing the Python-side image mode and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as L, and a later frame of the same dimensions switches to a wider mode such as RGB or CMYK, Pillow may decode wider pixels into the stale narrow native buffer. This causes native out-of-bounds writes and process crashes. In the MPO/JPEG path, I also demonstrated command e…","severity":"critical","techs":["python"],"cves":["CVE-2026-96639"],"tags":["GHSA-v9pv-5gc8-w2m6","Pillow"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:00:15.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}