CVE-2026-96638: Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
BmpRleDecoder can be forced to allocate gigabytes of memory from a kilobyte-sized crafted BMP file via unbounded growth in the delta escape and absolute mode branches.
References
- github.com/advisories/GHSA-24rc-8hj2-v98c
- github.com/python-pillow/Pillow/commit/e7794835e323ff2691d9b3a974cade1a44301b9a
- github.com/python-pillow/Pillow/pull/10015
- github.com/python-pillow/Pillow/releases/tag/13.0.0
- github.com/python-pillow/Pillow/security/advisories/GHSA-24rc-8hj2-v98c
- nvd.nist.gov/vuln/detail/CVE-2026-96638
Code Behaviors & Features
Detect and mitigate CVE-2026-96638 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →