Vulnerability · Published Oct 21, 2026 · Assigned by GitHub_M

CVE-2026-96638Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

Medium 6.5

In plain English

A medium-severity uncontrolled resource consumption in Pillow from python-pillow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 71.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining dest_length without a per-branch cap. A delta can add roughly 255 image rows in one iteration, so a kilobyte-sized file with a large but permitted width can expand the data bytearray to hundreds of megabytes or more, causing memory-exhaustion denial of service. This issue is fixed in version 13.0.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	pillow	no fix listed	DEBIAN-CVE-2026-96638
Debian:13	pillow	no fix listed	DEBIAN-CVE-2026-96638
Debian:14	pillow	no fix listed	DEBIAN-CVE-2026-96638
PyPI	pillow	13.0.0	GHSA-24rc-8hj2-v98c
Ubuntu:24.04:LTS	pillow	no fix listed	UBUNTU-CVE-2026-96638
Ubuntu:26.04:LTS	pillow	no fix listed	UBUNTU-CVE-2026-96638
Ubuntu:26.10	pillow	no fix listed	UBUNTU-CVE-2026-96638

Affected products (as reported)

Vendor	Product	Versions
python-pillow	Pillow	>= 9.1.0, < 13.0.0

Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

https://github.com/python-pillow/Pillow/security/advisories/GHSA-24rc-8hj2-v98c x_refsource_CONFIRM
https://github.com/python-pillow/Pillow/pull/10015 x_refsource_MISC
https://github.com/python-pillow/Pillow/commit/e7794835e323ff2691d9b3a974cade1a44301b9a x_refsource_MISC
https://github.com/python-pillow/Pillow/releases/tag/13.0.0 x_refsource_MISC