Threats tagged 'brew-aider-cve-2026-96637'

A vulnerability in Pillow's SpiderImagePlugin allows bypassing the decompression bomb check when seeking frames in multi-frame SPIDER stack files. This enables a crafted file under 1KB to trigger a very large memory allocation (multi-gigabyte) during image loading, causing a denial of service via unbounded memory consumption. The issue arises because the decompression bomb check is only performed once during the initial open, but not when seeking frames that re-parse header data and reset image size without validation.