## Pillow multi-frame loaders can reuse stale native image storage after mode transitions

- 種別: advisory
- 重大度: critical
- 関連技術: python
- CVE: CVE-2026-96639
- 公開日時: 2026-10-22T16:00:15.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-v9pv-5gc8-w2m6)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-v9pv-5gc8-w2m6

影響: pip:Pillow >= 11.0.0, < 13.0.0 → 13.0.0
Pillow multi-frame image loaders can retain native ImagingCore storage allocated for one frame while changing the Python-side image mode and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as L, and a later frame of the same dimensions switches to a wider mode such as RGB or CMYK, Pillow may decode wider pixels into the stale narrow native buffer. This causes native out-of-bounds writes and process crashes. In the MPO/JPEG path, I also demonstrated command e…