A critical out-of-bounds read and write vulnerability affects the Pillow Python imaging library versions 11.0.0 up to but not including 13.0.0. The flaw arises from multi-frame image loaders reusing stale native storage without verifying mode and size consistency, leading to memory corruption. Crafted image frames in PSD, MPO, DCX, or MIC formats can trigger crashes and, in some cases, command execution. This vulnerability is fixed in Pillow version 13.0.0.
A vulnerability in the python-pillow Pillow library prior to version 13.0.0 allows crafted multi-frame MPO or DCX images to cause uncontrolled memory consumption. This occurs because later frames can declare sizes that exceed limits without triggering decompression bomb checks, leading to potential denial of service via memory exhaustion. The issue is resolved in version 13.0.0.
A vulnerability in the python-pillow Pillow library versions 5.1.0 through 12.x allows an attacker to cause uncontrolled resource consumption. The PdfParser.linearize_page_tree() function treats a PDF /Pages graph as a tree without tracking duplicate indirect references, leading to exponential expansion of page references when processing a crafted PDF. This results in disproportionate CPU usage during the append operation. The issue is fixed in version 13.0.0.
A resource consumption vulnerability exists in python-pillow Pillow versions prior to 13.0.0. The SpiderImageFile.seek() function can reparse a later SPIDER stack frame and replace the image size without rerunning the decompression bomb check, allowing an attacker to declare very large image dimensions. This can cause excessive memory allocation, potentially consuming multiple gigabytes of memory. The issue is fixed in version 13.0.0.
CVE-2026-96643 is a high-severity vulnerability in the python-pillow Pillow library affecting versions from 11.0.0 up to but not including 13.0.0. The flaw involves inefficient algorithmic complexity in the Exif.load() function, which processes EXIF data in image files. Specifically, an uncapped PNG eXIf chunk with repeated headers can cause quadratic CPU usage due to repeated slicing and copying operations. This issue can be triggered through common image processing workflows such as Image.getexif(), Image._getexif(), and ImageOps.exif_transpose(). The vulnerability is fixed in version 13.0.0.
CVE-2026-96644 is an out-of-bounds read vulnerability in the python-pillow Pillow library affecting Windows builds. It arises from improper handling of EMF and WMF image dimensions, where 32-bit dimensions are truncated to 16-bit fields for allocation but used fully for copying data, causing a heap over-read. This can lead to memory disclosure or application crashes when processing crafted metafiles. The flaw is fixed in Pillow version 13.0.0.
CVE-2026-96641 is an integer overflow vulnerability in the python-pillow Pillow library prior to version 13.0.0. The flaw occurs in the PILfont text-width accumulation code where negative glyph advances are not properly checked against INT_MIN, allowing a signed 16-bit advance of -32768 to cause an integer overflow. This results in a large positive width from a negative calculation, potentially causing logic errors or excessive resource consumption in applications using text layout or size calculations. The issue is fixed in Pillow version 13.0.0.
CVE-2026-96642 is a high-severity vulnerability in the Python Pillow imaging library prior to version 13.0.0. The flaw exists in the TarIO initializer, which accepts a negative octal member size and causes a backward seek that loops on the same 512-byte header. This results in an infinite loop consuming a full CPU core when the requested member name does not match. This issue only occurs when applications directly use PIL.TarIO.TarIO instead of the standard Image.open() method. The vulnerability is fixed in Pillow version 13.0.0.
A vulnerability in the BmpRleDecoder component of the python-pillow Pillow library allows crafted BMP files to cause uncontrolled memory allocation. This occurs due to unbounded growth in the delta escape and absolute mode branches during decoding, leading to a severe memory amplification denial-of-service (DoS). The flaw affects all versions before 13.0.0. A fix is available in version 13.0.0 that caps memory growth and rejects out-of-bounds deltas.
LiteLLM version 1.107.0 was compromised in a supply chain attack affecting PyPI packages and Docker images. The malicious release includes Python startup files that execute automatically, stealing cloud credentials, private keys, browser data, and AI development tool authentication tokens. The attack used a lookalike repository in the release workflow and targets credentials for AWS, Azure, Google Cloud, GitHub CLI, SSH keys, npm/PyPI, and AI tools such as Claude, Gemini, and Cursor. Stolen data is encrypted and sent to a command-and-control server. A loader enables remote Python code execution. The package has approximately 23 million weekly downloads, indicating a significant potential impact.
Jupyter Server versions from 2.0.0 up to but not including 2.6.0 have a missing authorization check vulnerability related to kernel execution when using GatewayClient.url. This flaw allows a restricted authenticated user to bypass the configured authorizer and execute code on the kernel, potentially exposing sensitive data and allowing modification or disruption of the kernel environment. The issue is fixed in version 2.6.0. However, in 2.6.0 and later, if a deployment manually registers the deprecated gateway handlers module, the authorization bypass remains possible.
CVE-2026-113795 is a vulnerability in the py-pdf pypdf library prior to version 6.20.0. It involves uncontrolled resource consumption caused by processing crafted PDF streams with many filters or multiple filters that handle large data volumes. This can lead to excessive memory usage. The issue is resolved in version 6.20.0.
pypdf versions prior to 6.20.0 contain a vulnerability where processing a crafted incomplete PDF file that ends inside a standard cross-reference table can cause the library to enter an infinite loop. This issue is resolved in version 6.20.0.
CVE-2026-113793 is a medium severity vulnerability in the pypdf library prior to version 6.20.1. The issue involves an infinite loop triggered when removing an object from a crafted cyclic PDF tree, such as an outline item, which can block the current process. This flaw is fixed in version 6.20.1.
An infinite loop vulnerability exists in pypdf versions prior to 6.20.1. Specifically, calling PdfWriter.find_outline_item on a crafted PDF with a cyclic outline hierarchy can cause the process to hang indefinitely. This issue is resolved in version 6.20.1.
The moveworks-capi-starter package on PyPI contains malicious code that executes during installation. It overrides the install command in setup.py to collect the installer's hostname and local IP address, then sends this information as JSON to a hardcoded external URL without user consent or disclosure. The package has no legitimate documented functionality and acts as a proof-of-concept beacon. The exfiltrated data is limited to host identifiers and does not include credentials.
vLLM versions prior to 0.31.0 contain a cache aliasing vulnerability that allows authenticated attackers to cause collisions in shared cache keys by manipulating caller-controlled values such as EXIF ImageID or cache_salt. This can lead to attackers receiving cached processed media from other requests or reusing key-value state improperly. The vulnerability is fixed in version 0.31.0.