VulnSocial

CVE-2026-96639

LOWCVSS 9.8 ยท CRITICAL

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the stale native storage because _im is non-null without verifying that its mode and size still match. Crafted PSD, MPO, DCX, or MIC frame transitions can then write wider pixels into the narrow allocation, causing native out-of-bounds writes and crashes. The MPO path can also cause a native over-read and, in demonstrated runtime-specific profiles, command execution. This issue is fixed in version 13.0.0.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-125CWE-787

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post
  • Ashutosh@Ashutosh_Sidh

    ๐Ÿšจ ๐—ฆ๐—ฒ๐—ฐ๐˜‚๐—ฟ๐—ถ๐˜๐˜† ๐˜ƒ๐˜‚๐—น๐—ป๐—ฒ๐—ฟ๐—ฎ๐—ฏ๐—ถ๐—น๐—ถ๐˜๐—ถ๐—ฒ๐˜€ & ๐—ถ๐—ป๐—ฐ๐—ถ๐—ฑ๐—ฒ๐—ป๐˜๐˜€ (๐Ÿฎ๐Ÿฌโ€“๐Ÿฎ๐Ÿฎ ๐—ข๐—ฐ๐˜ ๐Ÿฎ๐Ÿฌ๐Ÿฎ๐Ÿฒ): ๐— ๐—ถ๐—ฐ๐—ฟ๐—ผ๐˜€๐—ผ๐—ณ๐˜ 1,400+ CVEs including actively exploited flaws. ๐—ข๐—ฟ๐—ฎ๐—ฐ๐—น๐—ฒ ๐—๐—ฎ๐˜ƒ๐—ฎ CVE-2026-91403 CVSS 9.1 JSSE update needed. ๐—ฃ๐—›๐—ฃ (๐—ฃ๐—›๐—ฃ๐Ÿฎ๐—ฆ๐—ต๐—ฒ๐—น๐—น) Unauthenticated RCE, patches available, exploits seen. ๐—š๐—ถ๐˜๐—Ÿ๐—ฎ๐—ฏ CVSS 10 unauthenticated RCE, patch immediately. ๐—ก๐—ผ๐—ฑ๐—ฒ.๐—ท๐˜€ 10 CVEs including Brotli decoder RCE fixed. ๐—–๐—ถ๐˜€๐—ฐ๐—ผ ๐—˜๐˜…๐—ฝ๐—ฟ๐—ฒ๐˜€๐˜€๐˜„๐—ฎ๐˜† CVSS 9.8 unauthenticated root RCE fixed. ๐—”๐—ฝ๐—ฎ๐—ฐ๐—ต๐—ฒ ๐—ง๐—ฟ๐—ฎ๐—ณ๐—ณ๐—ถ๐—ฐ ๐—ฆ๐—ฒ๐—ฟ๐˜ƒ๐—ฒ๐—ฟ Multiple CVSS 10 vulnerabilities disclosed. ๐—ฃ๐—น๐—ฒ๐˜… Four CVEs chain to unauthenticated RCE exploited. ๐—ฒ๐— ๐˜‚๐—ฑ๐—ต๐—ฟ๐—ฎ Eight intermediate CA keys trivially recoverable. ๐—ฃ๐˜†๐˜๐—ต๐—ผ๐—ป-๐—ฃ๐—ถ๐—น๐—น๐—ผ๐˜„ CVE-2026-96639 CVSS 9.8 imaging library flaw. ๐—Ÿ๐—ถ๐˜๐—ฒ๐—Ÿ๐—Ÿ๐—  Malicious package stole credentials, rotate secrets. ๐—ฅ๐—ฎ๐—ถ๐—น๐˜„๐—ฎ๐˜† Environment variables exposed, rotate all secrets. ๐—ก๐—š๐—œ๐—ก๐—ซ Five CVEs fixed including critical memory issues. ๐—š๐—ผ Blocked compromised eMudhra intermediates in crypto. ๐—ฆ๐—ถ๐˜๐—ฒ๐—š๐˜‚๐—ฎ๐—ฟ๐—ฑ OS command injection added to CISA KEV. ๐—ฆ๐—ถ๐—ฒ๐—บ๐—ฒ๐—ป๐˜€ Uncontrolled search path exploited, update now. ๐—จ๐—ป๐—ฏ๐—ผ๐˜‚๐—ป๐—ฑ DoQ use-after-free crash fixed in 1.26.2. ๐—ฆ๐—ถ๐—ด๐—ป๐—ฎ๐—น Call can keep receiving audio after hang-up.

    10010278
    2.4K followersView on X

Explore more

Back to dashboard