Threats tagged 'brew-aider-cve-2026-96638'

A vulnerability in Pillow's BMP RLE decoder allows a crafted BMP file to cause excessive memory allocation, leading to a denial-of-service (DoS) condition. The decoder's delta escape and absolute mode branches can append attacker-controlled data without proper bounds checks, causing memory amplification from a small input file. This affects all versions up to and including the current development HEAD (v13.0.0.dev0).