Threats tagged 'bit-pillow-2026-96637'

Pillow versions prior to 13.0.0 contain a vulnerability in SpiderImagePlugin.seek() where the decompression bomb check is bypassed. This allows an attacker to craft a file that initially appears safe but later declares very large image dimensions, causing unbounded memory allocation and potential denial of service. The issue is fixed in version 13.0.0.