CVE-2026-96778 · GHSA-g7cr-3p24-7wf7
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
- Risk score
- 63/100
- CVSS
- 7.7 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted free_in_buffer counter, which t…
- Affected
- Pillow (pip) >= 9.4.0, < 13.0.0
- Fix
- Upgrade Pillow to 13.0.0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
Pillow: Amber, patch this week. Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(). This can crash the process and may allow code execution.
The flaws
- CVE-2026-96778: Heap buffer overflow writing JPEG comment after ICC profile fills buffer (CVSS 7.7 · EPSS 0%)
- CVE-2026-112393: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (CVSS 9.2 · EPSS 1%)
- CVE-2026-96639: Pillow multi-frame loaders can reuse stale native image storage after mode transitions (CVSS 9.8 · EPSS 1%)
- CVE-2026-112900: Argument Injection in Ghostscript call, potentially leading into RCE (CVSS 9.2 · EPSS 0%)
The fix
Upgrade Pillow: 13.0.0 or later on your release line
Who is exposed: {'products': ['Pillow'], 'packages': ['Pillow'], 'versions': ['>= 2.0.0, < 13.0.0']}
Where it stands
- Public proof of concept
- 1 outlet covering it
How it unfolded
- 23 Oct, The Hacker News (press): Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
Connects to
- Same weakness: Out-of-bounds write (CWE-787). 257 other warnings in 30 days
Why it is Amber
- CVSS 7.7 high
- Remotely exploitable without logging in
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| Pillow | pip | >= 9.4.0, < 13.0.0 | 13.0.0 |
References
- https://github.com/advisories/GHSA-g7cr-3p24-7wf7
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-g7cr-3p24-7wf7
- https://nvd.nist.gov/vuln/detail/CVE-2026-96778
- https://github.com/python-pillow/Pillow/pull/10124
- https://github.com/python-pillow/Pillow/commit/02561b8dc6117d5670d4b469fecdd02c70854f9b
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0
- https://github.com/advisories/GHSA-g7cr-3p24-7wf7
Original description
Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted free_in_buffer counter, which then wraps and permits the attacker-controlled comment and subsequent compressed image data to overwrite adjacent heap memory. Re-saving an untrusted image as JPEG while preserving its ICC profile and forwarded comment can crash the process and may enable code execution in suitable runtime and heap layouts. This issue is fixed in version 13.0.0.
Last activity 21 Oct 2026. Patch Forecast updates every hour.