EUVD-2026-107563
GHSA-9v9v-9qvf-h2hj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted wide-short WMF/EMF file
-
DeliveryVictim Windows app loads and renders it via drawwmf
-
ExploitDimensions truncate to 16 bits, under-sizing DIB buffer
-
ExecutionPixel copy uses full dimensions, over-reads heap
-
ImpactDisclose adjacent memory or crash process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires all of: (1) the Windows platform - the vulnerable drawwmf handler in src/display.c is only installed/available on Windows, so Linux/macOS deployments are unaffected; (2) an application that loads WMF/EMF metafiles through Pillow's WmfImagePlugin and invokes the native renderer (e.g. calling load() to rasterize the metafile); and (3) a crafted metafile whose dimensions exceed the 16-bit field limit (width or height > 65535, e.g. a 68450x1 image produced via a 60000 DPI setting) while still passing the pixel-count decompression-bomb check. Limiting factors: the UI:P requirement means a user or application must actively render the file (it is not triggered by mere file receipt), and prior to 13.0.0 the handler accepted the oversized dimensions - the fix now rejects width/height <= 0 or > 65535 with a ValueError. |
| Impact | This is a moderate, defensively-relevant issue rather than an urgent emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H) scores 7.1 (High), and the impact profile is dominated by availability (VA:H, process crash) with only limited confidentiality loss (VC:L, partial memory disclosure) and no integrity impact - consistent with the CWE-125 out-of-bounds read described. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' Two factors materially lower real-world risk below what the 7.1 suggests: the flaw is Windows-only (it lives in the native drawwmf handler in src/display.c, which is only installed on Windows), and UI:P means a user or application must actively load/render the crafted metafile. The attack surface is therefore limited to Windows deployments that render untrusted WMF/EMF through Pillow's native handler. All signals are internally consistent - there is no CVSS-versus-description conflict here - but note the vendor CVSS is a 4.0 vector only, with no 3.1 score supplied, and no EPSS data to gauge exploitation likelihood. |
| Exploit ScenarioDerived | An attacker crafts a WMF/EMF file with deliberately wide, short dimensions (e.g. a 68450x1 image) that slips past Pillow's pixel-count decompression-bomb check, then gets a victim application on Windows to render it via the native drawwmf handler. The 16-bit-truncated bcWidth/bcHeight under-size the DIB allocation while the copy uses the full 32-bit dimensions, causing a heap over-read that can leak adjacent process memory or crash the renderer. No public exploit is referenced, but the fix commit and test case make the trigger condition explicit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 21, 2026
Heap buffer over-read in Pillow's Windows-only WMF/EMF renderer (versions prior to 13.0.0) lets a crafted wide, short metafile trigger out-of-bounds memory reads during rasterization. Pillow passes unchecked 32-bit metafile dimensions into the native drawwmf handler, which allocates a DIB using 16-bit-truncated width/height fields but then copies pixel data using the original full dimensions; because the truncated geometry keeps the total pixel count small, the image passes Pillow's decompression-bomb check while the copy still walks past the end of the heap buffer. Only Windows deployments that render attacker-supplied metafiles are exposed, and rendering must be explicitly initiated (UI:R); the practical outcome is limited disclosure of adjacent heap memory or a process crash via the enlarged read, with no public exploit identified at time of analysis and no CISA KEV listing.
Earlier versions of this analysis (1)
Heap out-of-bounds read in Pillow's WMF/EMF image decoder affects releases before 13.0.0 and is triggered when a crafted metafile supplies dimension values that truncate during processing. Applications that open attacker-controlled WMF or EMF images can expose process memory or crash the interpreter; the vendor rates this High, and no public exploit was identified at time of analysis. The assessed vector is network-reachable with low confidentiality and availability impact.
RemediationAI
Vendor-released patch: upgrade to Pillow 13.0.0, which validates dimensions in src/display.c (rejecting width/height <= 0 or > 65535 with ValueError) and rejects negative DPI in WmfImagePlugin.load(); install with 'pip install --upgrade Pillow==13.0.0' and confirm 'PIL.__version__'. Details are in the release notes (https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html), advisory GHSA-9v9v-9qvf-h2hj, and the fix commit https://github.com/python-pillow/Pillow/commit/4cf46bee338304c5c8968fd7f132ba0d40c428b7 (PR https://github.com/python-pillow/Pillow/pull/10120). If an immediate upgrade is not possible on Windows, the most direct compensating control is to unregister the native renderer with WmfImagePlugin.register_handler(None) so metafile loads raise an error instead of reaching drawwmf - at the cost of losing all WMF/EMF rasterization, which will break legitimate metafile conversion workflows. Alternatively, cap the DPI/size arguments supplied to load() at 65535 in the calling code, or route metafile rendering through a low-privilege, sandboxed worker process so an over-read can only leak memory within an isolated address space; both require application code changes and neither addresses the underlying C defect. Because exploitation requires a user or application to actively render the file, avoiding automatic rendering of untrusted metafiles (for example, thumbnailers or upload pipelines that rasterize attachments) removes the primary exposure path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pillow's WmfImagePlugin is a stub plugin that defers actual rasterization to a platform-specific handler; on Windows the default is the C extension drawwmf implemented in src/display.c (PyImaging_DrawWmf). The native Windows metafile handler describes the target bitmap with a BITMAPCOREHEADER, whose bcWidth and bcHeight members are 16-bit WORD fields. Prior to the fix, Python-side size computation in WmfImagePlugin.load() derived width and height from the metafile's 32-bit bounding box scaled by DPI, so values up to and beyond 65535 could be produced (for example, a 60000 DPI setting on the sample file yields a 68450x1 image). When those values were assigned into the 16-bit header fields they silently wrapped, so the DIB was allocated for the truncated geometry while the subsequent PyBytes_FromStringAndSize copy used the untruncated dimensions - a classic size-computation mismatch in the CWE-125 out-of-bounds read class. The pixel-count decompression-bomb guard did not catch it because a wide, short image has a deceptively small total pixel count. The fix in 13.0.0 adds explicit validation in src/display.c rejecting width or height <= 0 or > 65535 with ValueError("invalid dimensions"), rejects negative DPI values in the Python layer, and short-circuits zero-size renders with Image.new("RGB", im.size). Because the vulnerable handler is only installed on Windows (hasattr(Image.core, "drawwmf") is false elsewhere), Linux and macOS installations are not affected by this specific path.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Crafted metafile can be delivered remotely (AV:N) but an app/user must render it (UI:R), no auth needed (PR:N); over-read yields limited memory disclosure (C:L) and reliable crash (A:H), no integrity impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
Blast Radius
ecosystem impact- 89,616 pypi packages depend on pillow (20,283 direct, 70,825 indirect)
Ecosystem-wide dependent count for version 13.0.0.
Articles & Coverage 1
Technical POC Analysis
CWE-125 heap out-of-bounds read caused by a width mismatch between two representations of the same geometry.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Pillow, the Python imaging library embedded in many internal content-processing and file-handling services, carries a high-severity memory over-read in its Windows-only WMF/EMF renderer that can expose adjacent process memory or crash the application when a user opens a crafted metafile. Exposure is limited to Windows systems that explicitly render untrusted metafiles, so risk concentrates in upload, thumbnail, attachment-preview, and document-conversion workflows rather than core business platforms. Leadership should care because leaked heap memory can contain sensitive data from the same process, and repeated crashes can disrupt imaging pipelines; no public exploit or CISA KEV listing exists at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations are to disable or block WMF/EMF rendering entirely, enforce a PNG/JPEG-only image format allowlist, reject metafile uploads and attachments at ingress, run any unavoidable rendering in a low-privilege isolated worker without secret access, and monitor for process crashes or anomalous memory activity in imaging services.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Exploit-DB