CVE-2026-96637

A flaw was found in Pillow. When processing multi-frame SPIDER images, decompression bomb safeguards are not reapplied when navigating to subsequent frames that declare excessively large dimensions. A remote attacker could exploit this vulnerability by providing a specially crafted image file, leading to excessive memory consumption and a Denial of Service (DoS).

Red Hat has evaluated this vulnerability as having a Moderate severity impact because exploitation requires an application to parse multi-frame SPIDER image files and advance through secondary frames, limiting the consequence to memory exhaustion and denial of service without compromising confidentiality or integrity. The SPIDER image format is specialized and not typically accepted or processed by general enterprise workloads or default service configurations. Consequently, typical deployments remain unaffected unless custom application workflows explicitly ingest and iterate through untrusted multi-frame SPIDER datasets.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.