Search: CVE-2026-96643

CVE-2026-96643 is a high-severity vulnerability in the python-pillow Pillow library affecting versions from 11.0.0 up to but not including 13.0.0. The flaw involves inefficient algorithmic complexity in the Exif.load() function, which processes EXIF data in image files. Specifically, an uncapped PNG eXIf chunk with repeated headers can cause quadratic CPU usage due to repeated slicing and copying operations. This issue can be triggered through common image processing workflows such as Image.getexif(), Image._getexif(), and ImageOps.exif_transpose(). The vulnerability is fixed in version 13.0.0.