Threats tagged 'brew-aider-cve-2026-96636'

Pillow versions including 12.3.0 and development 13.0.0.dev0 have a vulnerability in the MPO and DCX multi-frame image handlers where decompression-bomb protection is bypassed on frames after the first. The decompression bomb check is only applied to the first frame during image open, but not when seeking to subsequent frames in MPO and DCX formats. This allows crafted images with a small first frame and an extremely large subsequent frame to cause excessive memory allocation, leading to denial of service via memory exhaustion.