CVE-2026-96636: Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
Pillow’s decompression-bomb protection (Image._decompression_bomb_check, gated by Image.MAX_IMAGE_PIXELS) is enforced only on the first frame, inside Image.open(). For multi-frame formats, seek() re-parses the target frame’s header and resets self._size. GifImagePlugin and TiffImagePlugin re-run the bomb check on seek(), but MpoImageFile.seek() and DcxImageFile.seek() do not. A crafted MPO or DCX whose first frame is tiny (passing the check) but whose later frame declares enormous dimensions therefore bypasses the protection: loading that frame decodes an over-limit image and commits large amounts of memory — a denial of service (memory exhaustion / OOM).
Same class as the recently assigned CVE-2026-55379 (BdfFontFile), CVE-2026-55380 (GdImageFile) and CVE-2026-40192 (FITS GZIP).
References
- github.com/advisories/GHSA-p8hx-v2p6-rp84
- github.com/python-pillow/Pillow/commit/f1acfc54c53502948d0d14121872061df931db48
- github.com/python-pillow/Pillow/pull/10011
- github.com/python-pillow/Pillow/releases/tag/13.0.0
- github.com/python-pillow/Pillow/security/advisories/GHSA-p8hx-v2p6-rp84
- nvd.nist.gov/vuln/detail/CVE-2026-96636
Code Behaviors & Features
Detect and mitigate CVE-2026-96636 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →