Pillow CVE-2026-96639

Requires an application using Pillow 11.0.0 up to (not including) 13.0.0 to open an attacker-supplied multi-frame image in PSD, MPO, DCX, or MIC format and to advance past the first frame (seek/load a later frame). The specific trigger is a later frame of the same dimensions whose logical mode widens to RGB or CMYK (or whose size changes) relative to an earlier narrow-mode frame, causing load_prepare() to reuse the stale native allocation because _im is non-null. Limiting factors: the application must actually process multi-frame files and iterate frames rather than reading only the first frame; no authentication is required (PR:N), and no end-user interaction is needed in an automated pipeline. The crash and out-of-bounds read are reliably reachable, but code execution is limited to the MPO path and specific runtime/heap profiles, so most deployments realistically face DoS or memory disclosure rather than RCE.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) yields a 9.8 Critical and, taken alone, implies trivial remote unauthenticated exploitation. However, the description reveals this is a memory-safety flaw in a parsing library triggered only when an application opens and advances through frames of an attacker-supplied multi-frame image (PSD, MPO, DCX, or MIC), so real-world risk hinges on whether the consuming application processes untrusted multi-frame files and seeks later frames. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no signal of widespread active exploitation; the matched phrase is 'no public exploit identified at time of analysis' (the patch-commit and test diffs on GitHub demonstrate the fix, not a weaponized exploit). The most reliable outcomes are native out-of-bounds writes (crash/DoS) and, on the MPO path, an over-read (information disclosure); the claimed command execution is explicitly scoped to 'demonstrated runtime-specific profiles' and is heap-layout-dependent, so RCE should be treated as conditional rather than guaranteed. Net: a genuinely high-severity memory-corruption bug in an extremely common library, but exploitation is gated by application behavior and the RCE claim is not independently confirmed - prioritize patching, but the 9.8 overstates the likelihood of reliable remote code execution against arbitrary deployments.

An attacker submits a crafted multi-frame image (PSD, MPO, DCX, or MIC) to a service built on Pillow 11.0.0-12.x that opens the file and iterates frames; an earlier narrow-mode frame allocates a small ImagingCore buffer, and a later same-size frame that switches the logical mode to wider RGB/CMYK causes load_prepare() to reuse the stale allocation, writing wider pixels past the buffer. This produces native out-of-bounds writes (crash or memory corruption) or, via the MPO path, an over-read leaking memory, with command execution possible in specific runtime profiles. No public exploit code was identified in the provided data.