Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

影響: pip:pillow >= 9.1.0, < 13.0.0 → 13.0.0

BmpRleDecoder can be forced to allocate gigabytes of memory from a kilobyte-sized crafted BMP file via unbounded growth in the delta escape and absolute mode branches. Affected versions All versions up to and including current HEAD (v13.0.0.dev0, commit e7a7ea84) Root cause BmpRleDecoder.decode() (BmpImagePlugin.py:327-395) builds a Python bytearray data with dest_length = xsizeysize, looping while len(data) up to ~255xsize bytes in ONE iteration. - absolute mode (line 385): data += bytes_read…

GitHub Advisory Databaseで読む

2026/10/23 00:59、GitHub Advisory Databaseが「Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Python。CVE: CVE-2026-96638。