Pillow multi-frame loaders can reuse stale native image storage after mode transitions
影響: pip:Pillow >= 11.0.0, < 13.0.0 → 13.0.0
Pillow multi-frame image loaders can retain native ImagingCore storage allocated for one frame while changing the Python-side image mode and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as L, and a later frame of the same dimensions switches to a wider mode such as RGB or CMYK, Pillow may decode wider pixels into the stale narrow native buffer. This causes native out-of-bounds writes and process crashes. In the MPO/JPEG path, I also demonstrated command e…
| CVE | CVE-2026-96639 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 23. 오전 05:09 |
| 데이터 | Markdown JSON |
2026. 10. 23. 오전 01:00, GitHub Advisory Database에서 "Pillow multi-frame loaders can reuse stale native image storage after mode transitions"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "긴급"(critical)입니다. 관련 기술: Python. CVE: CVE-2026-96639.