Search: CVE-2026-96638

A vulnerability in the BmpRleDecoder component of the python-pillow Pillow library allows crafted BMP files to cause uncontrolled memory allocation. This occurs due to unbounded growth in the delta escape and absolute mode branches during decoding, leading to a severe memory amplification denial-of-service (DoS). The flaw affects all versions before 13.0.0. A fix is available in version 13.0.0 that caps memory growth and rejects out-of-bounds deltas.