CVE-2026-96639 | python-pillow Pillow up to 12.x Multi-Frame Loaders ImageFile.load_prepare out-of-bounds write

October 21, 2026 Yanac

A vulnerability marked as critical has been reported in python-pillow Pillow up to 12.x. This affects the function ImageFile.load_prepare of the component Multi-Frame Loaders. The manipulation leads to out-of-bounds write.

This vulnerability is traded as CVE-2026-96639. It is possible to initiate the attack remotely. There is no exploit available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More