CVE-2026-96638 | Pillow up to 12.x RLE Decoder BmpImagePlugin.py BmpRleDecoder.decode denial of service

October 21, 2026 Yanac

A vulnerability described as problematic has been identified in Pillow up to 12.x. Affected by this vulnerability is the function BmpRleDecoder.decode of the file src/PIL/BmpImagePlugin.py of the component RLE Decoder. Executing a manipulation can lead to denial of service.

This vulnerability is handled as CVE-2026-96638. The attack can be executed remotely. There is not any exploit available.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More