Pillow multi-frame loaders can reuse stale native image storage after mode transitions

影響: pip:Pillow >= 11.0.0, < 13.0.0 → 13.0.0

Pillow multi-frame image loaders can retain native ImagingCore storage allocated for one frame while changing the Python-side image mode and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as L, and a later frame of the same dimensions switches to a wider mode such as RGB or CMYK, Pillow may decode wider pixels into the stale narrow native buffer. This causes native out-of-bounds writes and process crashes. In the MPO/JPEG path, I also demonstrated command e…

Read on GitHub Advisory Database

On 10/23/2026, 01:00 AM, GitHub Advisory Database published "Pillow multi-frame loaders can reuse stale native image storage after mode transitions" (type: Advisory). Severity is "Critical" (critical). Related technologies: Python. CVE: CVE-2026-96639.