Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
影響: pip:pillow < 13.0.0 → 13.0.0
SpiderImagePlugin's seek() bypasses the decompression bomb check, allowing a tiny ( DecompressionBombWarning fires correctly. - BYPASS: Image.open(stack, frame0=1x1) passes; im.seek(1) sets size (100,100) with NO DecompressionBombWarning/Error -> the check is bypassed. Real-world impact: a large frame-1 nsam/nrow (e.g. 40000x40000) causes im.load() to allocate ~6.4 GB (mode F) with the bomb check fully bypassed, from a file under 1 KB. Suggested fix Call Image._decompression_bomb_check(self.siz…
Read on GitHub Advisory Database
| CVE | CVE-2026-96637 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/23/2026, 05:09 AM |
| Data | Markdown JSON |
On 10/23/2026, 12:57 AM, GitHub Advisory Database published "Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS" (type: Advisory). Severity is "High" (high). Related technologies: Python. CVE: CVE-2026-96637.