Threats tagged 'bit-pillow-2026-96636'

Pillow versions prior to 13.0.0 contain a vulnerability where the decompression-bomb protection can be bypassed via multi-frame seek() operations in MPO and DCX image files. This allows a crafted multi-frame image to pass initial checks with a small first frame but later declare an excessively large frame, leading to memory exhaustion and denial of service when that frame is decoded. The issue is fixed in version 13.0.0.