Search: CVE-2026-96639

A critical out-of-bounds read and write vulnerability affects the Pillow Python imaging library versions 11.0.0 up to but not including 13.0.0. The flaw arises from multi-frame image loaders reusing stale native storage without verifying mode and size consistency, leading to memory corruption. Crafted image frames in PSD, MPO, DCX, or MIC formats can trigger crashes and, in some cases, command execution. This vulnerability is fixed in Pillow version 13.0.0.