CVE-2026-96636: CWE-400: Uncontrolled Resource Consumption in python-pillow Pillow

The vulnerability arises because MpoImageFile.seek() and DcxImageFile.seek() methods in Pillow versions before 13.0.0 reparse later frames of multi-frame MPO or DCX images and update the image size without rerunning the Image._decompression_bomb_check(). An attacker can craft a multi-frame image with a small first frame to bypass initial checks and then include a later frame that exceeds memory limits. When this later frame is decoded via seek(), load(), or ImageSequence.Iterator, it can consume hundreds of megabytes or more, leading to memory exhaustion and denial of service. The issue is resolved in Pillow 13.0.0.

An attacker can cause a denial of service by supplying a crafted multi-frame image that triggers excessive memory consumption during image processing. This can crash or severely degrade the availability of applications using vulnerable Pillow versions. There is no impact on confidentiality or integrity reported.

Upgrade to Pillow version 13.0.0 or later, where this vulnerability is fixed. No other mitigation is required as the fix addresses the root cause by rerunning the decompression bomb check on later frames.