Key points
- Pillow versions earlier than 13.0.0 are vulnerable to CVE-2026-96644.
- The flaw affects only Windows builds due to native code compilation constraints.
- The issue causes a heap over-read, not arbitrary code execution or remote execution.
Pillow 13.0.0 has been released to address CVE-2026-96644, a high-severity heap over-read vulnerability. The flaw exists in the library’s handling of EMF and WMF image formats specifically on Windows operating systems. Security researchers identified that the native handler processes image dimensions incorrectly, leading to memory access violations when specific metafiles are loaded.
The vulnerability stems from a mismatch between allocation size and copy length. On Windows builds, Pillow stores EMF and WMF image dimensions without performing a range check before passing them to the native `drawwmf` handler. This handler allocates memory based on dimensions truncated into 16-bit header fields. However, it subsequently copies data using the full 32-bit dimensions. This discrepancy allows a crafted metafile to bypass decompression-bomb checks while triggering a heap over-read.
Technical Mechanics
The root cause lies in how the `WmfImagePlugin` module interacts with the native C handler. The plugin reads the bounding box from the file and stores it without verifying positivity or range limits. These values reach the native handler through specific interface functions. Within the handler, the DIB header fields for width and height are only 16 bits wide. This truncation reduces the allocation size significantly. Yet the copy operation calculates the byte count using the original, untruncated 32-bit integers.
A proof-of-concept demonstrates that a wide but short metafile can exploit this gap. For instance, a bounding box of 70,000 by 1 pixel passes standard pixel-count checks. However, the width truncates to 16 bits for memory allocation, while the copy routine attempts to read using the full width. This results in reading beyond the allocated heap buffer. The entire vulnerable handler is compiled exclusively for Windows, as indicated by preprocessor directives in the source code.
Affected Environments
Only Windows systems running Pillow versions earlier than 13.0.0 are affected. The native handler responsible for the flaw is guarded by a Windows-specific compilation flag. Consequently, Linux and other Unix-like systems do not execute this vulnerable code path. Organizations using Pillow for image processing in Windows environments should verify their current version immediately. The fix is available in version 13.0.0.
Next steps
Administrators should audit their Python environments for Pillow installations. Identify any versions prior to 13.0.0 and plan an upgrade to the patched release. Until the update is deployed, restrict the processing of untrusted EMF and WMF files on Windows systems. Monitor application logs for unexpected memory access errors or crashes when handling these image formats.
Signals worth monitoring
Teams usually observe heap corruption indicators when this type of vulnerability is triggered. Check for application crashes or access violations in Windows Event Logs specifically during image processing tasks. Monitor for abnormal memory usage patterns in services that routinely parse user-supplied graphics files. Look for unexpected termination of worker threads that handle graphic rendering. Verify that error handling routines capture and report these low-level memory faults. Ensure that security information and event management platforms ingest these specific error codes for correlation.
What to do and how to stay safe: Pillow
- Update Pillow to version 13.0.0 or later on all Windows systems immediately.
- Restrict input to trusted image formats if an immediate patch cannot be applied.
- Monitor Windows Event Logs for application crashes related to graphic processing.
- Validate that all Python dependencies are current before processing untrusted files.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-96644?
The vulnerability is rated high severity according to the GitHub advisory GHSA-9v9v-9qvf-h2hj.
Does this vulnerability allow remote code execution?
No, the source material states it causes a heap over-read, not arbitrary code execution.
Are Linux systems affected by this flaw?
No, the vulnerable handler is compiled only on Windows, leaving other systems unaffected.
