CVE-2026-96778

A flaw was found in Pillow. A remote attacker could exploit a heap buffer overflow vulnerability to achieve arbitrary code execution or cause a Denial of Service (DoS). This issue occurs when an application re-encodes an untrusted image into JPEG format while preserving specially crafted color profile and comment metadata, causing an internal memory buffer to overflow. Successful exploitation allows adjacent memory to be overwritten, which can crash the application or permit code execution in suitable runtime environments.

Red Hat evaluates this vulnerability as having an Important severity because an unauthenticated attacker could trigger memory corruption leading to denial of service or arbitrary code execution if an exposed service processes untrusted graphics. In Red Hat ecosystems, Pillow is bundled across various containerized environments, including Red Hat OpenShift AI and Ansible Automation Platform, where background services or pipelines may ingest media files. However, exploitation requires an application workflow that explicitly re-encodes user-supplied images into JPEG format while retaining both embedded color profiles and comment metadata, which restricts the attack surface to specific image handling operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.