CVE-2026-96639
Pillow multi-frame loaders can reuse stale native image storage after mode transitions
Pillow multi-frame image loaders can retain native ImagingCore storage allocated for one frame while changing the Python-side image mode and decoder tiles for a later frame.
- No known exploitation
- Severity
- Critical, CVSS 9.8 (v3.1)
- EPSS
- 0.57% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- Pillow (pip) >= 11.0.0, < 13.0.0, fixed in 13.0.0 · GHSA-v9pv-5gc8-w2m6