Pillow multi-frame loaders can reuse stale native image storage after mode transitions

影響: pip:Pillow >= 11.0.0, < 13.0.0 → 13.0.0

Pillow multi-frame image loaders can retain native ImagingCore storage allocated for one frame while changing the Python-side image mode and decoder tiles for a later frame. If frame 0 allocates storage for a narrow mode such as L, and a later frame of the same dimensions switches to a wider mode such as RGB or CMYK, Pillow may decode wider pixels into the stale narrow native buffer. This causes native out-of-bounds writes and process crashes. In the MPO/JPEG path, I also demonstrated command e…

在 GitHub Advisory Database 阅读

2026/10/23 01:00，GitHub Advisory Database 发布了“Pillow multi-frame loaders can reuse stale native image storage after mode transitions”（类型：漏洞公告）。严重程度为“严重”（critical）。相关技术：Python。CVE：CVE-2026-96639。