CVE-2026-96644 | Pillow up to 12.x WMF Image WmfImagePlugin.py heap-based overflow

October 21, 2026 Yanac

A vulnerability was found in Pillow up to 12.x and classified as critical. The affected element is an unknown function of the file src/PIL/WmfImagePlugin.py of the component WMF Image Handler. Executing a manipulation can lead to heap-based buffer overflow.

This vulnerability is tracked as CVE-2026-96644. The attack can be launched remotely. No exploit exists.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More