Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)

影響: pip:Pillow < 13.0.0 → 13.0.0

On Windows builds, Pillow stores EMF and WMF image dimensions without a range check and passes them to the native drawwmf handler. That code sizes its allocation from dimensions truncated into 16-bit header fields but copies the result using the full 32-bit dimensions. A crafted metafile that is wide and short passes the decompression-bomb pixel check yet causes a heap over-read. Details The EMF branch computes the size straight from signed 32-bit header fields and stores it with no positivity…

在 GitHub Advisory Database 阅读

2026/10/23 01:03，GitHub Advisory Database 发布了“Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Python。CVE：CVE-2026-96644。