Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

影響: pip:pillow >= 9.1.0, < 13.0.0 → 13.0.0

BmpRleDecoder can be forced to allocate gigabytes of memory from a kilobyte-sized crafted BMP file via unbounded growth in the delta escape and absolute mode branches. Affected versions All versions up to and including current HEAD (v13.0.0.dev0, commit e7a7ea84) Root cause BmpRleDecoder.decode() (BmpImagePlugin.py:327-395) builds a Python bytearray data with dest_length = xsizeysize, looping while len(data) up to ~255xsize bytes in ONE iteration. - absolute mode (line 385): data += bytes_read…

在 GitHub Advisory Database 阅读

2026/10/23 00:59，GitHub Advisory Database 发布了“Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Python。CVE：CVE-2026-96638。