Key points
- CVE-2026-96637 affects Pillow versions below 13.0.0.
- The SpiderImagePlugin lacks decompression bomb checks during frame seeking.
- Patched version 13.0.0 addresses the allocation bypass.
A vulnerability in the Pillow image library allows attackers to bypass decompression bomb protections through the SpiderImagePlugin. This flaw, tracked as CVE-2026-96637, is rated high severity by GitHub. It affects all versions of Pillow up to and including the current development head before the release of version 13.0.0.
The issue arises because the plugin’s seek function re-parses image headers without re-validating size limits. According to the advisory, this allows a small crafted file to trigger multi-gigabyte memory allocations. The vulnerability exists because the standard safety check runs only once during initial image opening, not during subsequent frame access.
Technical details of the bypass
The root cause lies in how SpiderImagePlugin handles multi-frame files. When an image is opened, Pillow runs a decompression bomb check. However, the Spider plugin’s seek method calls the internal open function directly, bypassing this safety layer. It reads size data from unvalidated header fields, leading to unchecked memory allocation.
Other plugins like GIF and TIFF include additional checks during seeking. The Spider plugin lacked these safeguards. This mirrors similar flaws recently fixed in GdImageFile and FontFile classes. The vulnerability allows an attacker to specify dimensions that exceed safe limits, causing significant resource consumption.
Who is affected
System administrators using Pillow versions earlier than 13.0.0 are exposed to this risk. The vulnerability impacts any environment processing SPIDER stack files. Users of the latest patched version, 13.0.0, are protected from this specific bypass. The advisory notes that the flaw allows tiny files to cause large allocations.
Next steps
Teams should verify their Pillow version immediately. If running a version below 13.0.0, upgrading is necessary to mitigate this risk. No other fixes have been confirmed for older versions. Administrators should monitor for unexpected memory usage spikes in services handling image uploads.
Signals worth monitoring
Teams usually observe sudden memory exhaustion on servers processing user-uploaded images. Check for spikes in RAM usage that correlate with small file uploads. Look for alerts indicating out-of-memory conditions in application logs. Verify that image processing services are restarting unexpectedly due to resource limits. Containment often involves isolating the affected service and reviewing recent image ingestion patterns for anomalies.
What to do and how to stay safe: Pillow
- Audit your environment to identify all systems running Pillow versions prior to 13.0.0.
- Restrict image upload endpoints to accept only trusted file types if immediate patching is not possible.
- Monitor server memory usage closely for anomalous spikes following image processing tasks.
- Review logs for any services that handle SPIDER or multi-frame image formats for signs of abuse.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Pillow versions are vulnerable to CVE-2026-96637?
All versions of Pillow up to and including the current development head before 13.0.0 are affected.
Is there a confirmed patch for this vulnerability?
Yes, the issue is fixed in Pillow version 13.0.0.
What type of files trigger this vulnerability?
Crafted SPIDER stack files can trigger the decompression bomb bypass.
