Pillow EUVD-2026-107562

Exploitation requires the application to load and use a legacy PILfont (.pil bitmap font) whose glyph/metric data has been manipulated to trigger the underflow during text-width calculation; it is not reachable through ordinary image decoding. Limiting factors: PILfonts are a legacy, rarely attacker-supplied input (most applications ship trusted fonts), so the attack surface is narrow and typically local file-based rather than remote; the application must specifically load the malicious font and perform text measurement/rendering with it. There is no indication of required authentication from any CVSS vector (none provided), so authentication requirements are not confirmed from available data.

CVE-2026-96641 is one entry (rated Medium by the Pillow project) in the large batch of vulnerabilities fixed in Pillow 13.0.0 - specifically an integer underflow in the PILfont text-width calculation path (GHSA-4rm8-3hmm-39fg). No CVSS vector, CWE, EPSS score, KEV listing, or POC indicator was provided in the input, so several standard prioritization signals are simply absent and cannot be presented as known. Based on the description alone, this is a memory-safety/computation flaw in legacy bitmap-font (.pil) handling, and the realistic worst case is a denial of service or out-of-bounds read when a crafted or malformed PILfont is loaded and used to measure text - not a high-value remote code execution primitive. The signals that exist point to LOW real-world urgency: the vendor itself classified it Medium, the attack requires the application to process an attacker-influenced PILfont (an uncommon untrusted input compared to ordinary image files), and there is no evidence of exploitation or public exploit code. EPSS is unavailable, so exploitation probability cannot be quantified; KEV status is not listed, consistent with no observed active exploitation. Net: despite Pillow's enormous deployment footprint, this specific issue is a patch-in-routine-cycle item rather than an emergency, and it should not be elevated to a high priority absent additional evidence (e.g., a confirmed OOB read leading to information disclosure).

An application using Pillow loads an attacker-supplied legacy PILfont (.pil) file and calls a text-measurement routine (e.g., computing text width for layout); the integer underflow corrupts the width computation, causing a crash or an out-of-bounds read and resulting in denial of service for the processing service. No public exploit code was identified in the provided data, and exploitation depends on the application accepting or rendering with untrusted PILfont data rather than ordinary trusted bundled fonts.