Search: CVE-2026-96778

A heap out-of-bounds write vulnerability exists in the Pillow Python imaging library versions 9.4.0 through 12.x, fixed in 13.0.0. The flaw occurs in the JPEG encoding process when handling ICC profiles that exactly fill the 65536-byte encoder buffer, allowing an attacker-controlled comment and image data to overwrite adjacent heap memory. This can cause a crash or potentially enable code execution under certain runtime and heap conditions.