Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
影響: pip:Pillow < 13.0.0 → 13.0.0
On Windows builds, Pillow stores EMF and WMF image dimensions without a range check and passes them to the native drawwmf handler. That code sizes its allocation from dimensions truncated into 16-bit header fields but copies the result using the full 32-bit dimensions. A crafted metafile that is wide and short passes the decompression-bomb pixel check yet causes a heap over-read. Details The EMF branch computes the size straight from signed 32-bit header fields and stores it with no positivity…
| CVE | CVE-2026-96644 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 23. 오전 05:09 |
| 데이터 | Markdown JSON |
2026. 10. 23. 오전 01:03, GitHub Advisory Database에서 "Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: Python. CVE: CVE-2026-96644.