Search: CVE-2026-96637

A resource consumption vulnerability exists in python-pillow Pillow versions prior to 13.0.0. The SpiderImageFile.seek() function can reparse a later SPIDER stack frame and replace the image size without rerunning the decompression bomb check, allowing an attacker to declare very large image dimensions. This can cause excessive memory allocation, potentially consuming multiple gigabytes of memory. The issue is fixed in version 13.0.0.