Can Crafted PSD, MPO, DCX, or MIC Files Trigger Out-of-Bounds Writes in Pillow 11-13?

The short version

• Pillow versions 11.0.0 up to 13.0.0 contain a critical out-of-bounds write flaw.
• Crafted multi-frame images can cause crashes or command execution.
• Version 13.0.0 fixes the issue.

The details

The Python Imaging Library, known as Pillow, contains a critical vulnerability rated 9.8 by the National Vulnerability Database. The flaw, identified as CVE-2026-96639, exists in versions 11.0.0 up to 13.0.0. It arises when multi-frame image loaders retain native storage allocated for one frame while processing a subsequent frame with different properties. Specifically, the `ImageFile.load_prepare()` function reuses existing `ImagingCore` storage if the `_im` variable is not null. It fails to verify whether the stored mode and size match the new frame’s requirements. This mismatch allows wider pixel data to be written into a narrower buffer, causing out-of-bounds writes.

The context

Several file formats are vulnerable to this memory corruption issue. The PSD loader can switch from grayscale to RGB layer decoding while retaining the original storage, leading to reliable crashes. The MPO and JPEG paths are particularly severe; a crafted two-frame MPO file can allocate narrow storage for the first frame, then decode CMYK or RGB data into that buffer for the second frame. Researchers demonstrated command execution in this path using the `ImageSequence.Iterator` method. Additionally, DCX and MIC formats exhibit similar behaviour where mode changes occur without invalidating the native storage, resulting in crashes or over-reads.

Next steps

The vendor has released version 13.0.0, which fixes this issue. Users running affected versions should upgrade immediately. Until upgraded, systems processing untrusted multi-frame images remain exposed to memory corruption and potential remote code execution.

What defenders should look for

Security teams should monitor for unexpected process crashes in services handling image uploads. Look for signs of memory corruption, such as segmentation faults or illegal instruction errors, in application logs. Check for anomalous network connections originating from image processing services, which may indicate command execution. Investigate any instances where image files are processed in temporary directories, as attackers may attempt to write payloads. Ensure that image processing services run with minimal privileges to limit the impact of potential exploitation. Review access controls to prevent untrusted users from uploading multi-frame image files.

What to do and how to stay safe: Pillow

• Upgrade Pillow to version 13.0.0 or later to patch the vulnerability.
• Monitor application logs for crashes or memory errors in image processing services.
• Restrict uploaded image formats to those that do not support multi-frame data if possible.
• Run image processing services with least-privilege accounts to limit potential damage.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Pillow versions are affected by CVE-2026-96639?

Versions 11.0.0 up to, but not including, 13.0.0 are affected.

What file formats are vulnerable to this flaw?

PSD, MPO, DCX, and MIC file formats are affected.

Is there a fix available for this vulnerability?

Yes, version 13.0.0 fixes the issue.