Pillow EUVD-2026-104604

Exploitation requires that the target application decode attacker-controlled data through Pillow's raw decoder using the planar palette raw modes 'P;2L' or 'P;4L' (for example via Image.frombuffer or Image.frombytes), supplying a buffer and image dimensions whose accepted packed-row size is smaller than the unpacker's padded bit-plane footprint. Limiting factors that reduce real-world exposure: these planar palette raw modes are uncommon and must be explicitly selected by the calling application rather than being triggered by ordinary image-file opening/auto-detection; the impact is bounded to leaking up to three adjacent heap bytes or a process crash, with no code execution or integrity loss. The AT:P metric in the vendor vector reflects this required non-default decoding configuration.

This is a genuine but moderate-severity memory-safety defect (CWE-126 buffer over-read), not a top-tier priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L, score 6.3) correctly signals a network-reachable, unauthenticated issue with LOW confidentiality and LOW availability impact and NO integrity impact - consistent with the description's claim of disclosing up to three adjacent heap bytes or crashing the process. The pivotal and easily-overlooked metric is AT:P (Attack Requirements: Present): exploitation is not against a passively-parsed image file but requires the application to invoke Pillow's raw decoder with the uncommon 'P;2L' or 'P;4L' rawmodes while passing attacker-influenced buffer contents and dimensions. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. This CVE is NOT in CISA KEV and no public exploit code was supplied, so exploitation status is 'no public exploit identified at time of analysis'; note the fix commit and its regression tests publicly demonstrate the triggering conditions, which lowers the barrier to crafting a POC even though none is cited here. Net: real but low-to-moderate real-world risk - the modest impact ceiling (a few bytes of heap disclosure or a crash) combined with the atypical API precondition means this ranks well below a remote code execution flaw despite Pillow's enormous install base.

An application exposes an endpoint that constructs a Pillow image from user-supplied bytes using Image.frombuffer/frombytes with the 'P;2L' or 'P;4L' raw mode and attacker-influenced dimensions. The attacker submits a buffer whose accepted size is smaller than the unpacker's actual padded-bit-plane footprint, causing ImagingRawDecode to read past the buffer end and either leak up to three adjacent heap bytes into the decoded output or crash the process. No public exploit is identified at time of analysis, though the fix's regression tests publicly illustrate the exact size/mode combinations that trigger the condition.