CVE-2026-96639

A flaw was found in Pillow. When processing multi-frame images that transition between different color modes, Pillow reuses an undersized native memory buffer without verifying that its format matches the subsequent frame. A remote attacker can exploit this flaw by providing a specially crafted multi-frame image file, causing an out-of-bounds memory write. Successful exploitation can lead to arbitrary code execution or a Denial of Service (DoS) resulting from an application crash.

This vulnerability is rated Critical because network-facing services that ingest and process untrusted multi-frame images can be exploited without privileges or user interaction, potentially resulting in memory corruption and remote code execution. Applications parsing sequential frames in formats such as MPO, PSD, or DCX are exposed when handling transitions between varying color modes within the same file. Red Hat Enterprise Linux releases distributing versions prior to Pillow 11.0.0 are unaffected as they lack the affected storage reuse implementation.