CVE-2026-96637: CWE-400: Uncontrolled Resource Consumption in python-pillow Pillow

The vulnerability exists in Pillow versions before 13.0.0 in the SpiderImageFile.seek() method located in src/PIL/SpiderImagePlugin.py. The method reparses a later SPIDER stack frame and replaces the internal _size attribute without rerunning the Image._decompression_bomb_check(). This allows an attacker to create a file with a safe initial frame that passes Image.open(), but subsequently declares very large dimensions in a later mode F frame. Loading this frame causes the library to allocate approximately four bytes per pixel, potentially consuming multiple gigabytes of memory and leading to uncontrolled resource consumption (CWE-400). This flaw was addressed and fixed in Pillow 13.0.0.

This vulnerability can cause excessive memory consumption when processing maliciously crafted image files, potentially leading to denial of service due to resource exhaustion. There is no indication of code execution or data corruption. The CVSS 4.0 base score is 7.1 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on availability.

Upgrade to Pillow version 13.0.0 or later, where this vulnerability is fixed. No other mitigation is indicated or required according to the available data.