Pillow multi-frame loaders can reuse stale native image storage after mode transitions

影響: pip:Pillow >= 11.0.0, < 13.0.0 → 13.0.0

Pillow multi-frame image loaders can retain native ImagingCore storage allocated for one frame while changing the Python-side image mode and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as L, and a later frame of the same dimensions switches to a wider mode such as RGB or CMYK, Pillow may decode wider pixels into the stale narrow native buffer. This causes native out-of-bounds writes and process crashes. In the MPO/JPEG path, I also demonstrated command e…

GitHub Advisory Databaseで読む

2026/10/23 01:00、GitHub Advisory Databaseが「Pillow multi-frame loaders can reuse stale native image storage after mode transitions」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「緊急」(critical) です。関連する技術: Python。CVE: CVE-2026-96639。