CVE-2026-96644

High

Description

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using the original full dimensions. A crafted wide, short metafile can pass the pixel-count decompression-bomb check and make the Windows-only renderer read beyond the heap buffer, potentially disclosing memory or crashing the process. This issue is fixed in version 13.0.0.

SeverityHigh

CVSS8.1

Exploit probability—

Product

Python Pillow

PublishedOct 21, 2026

First seenOct 21, 2026

Weakness typeCWE-125Out-of-bounds read

How to fix

Update

python pillow13.0.0 or later
pillow13.0.0 or later

Affected products

Product	Affected versions	Fixed in
python pillow	v < 13.0.0	13.0.0
pillowPyPI	v < 13.0.0	13.0.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.