Threats tagged 'brew-aider-cve-2026-96639'

Pillow's multi-frame image loaders can reuse stale native image storage when switching image modes between frames, leading to native out-of-bounds writes, crashes, and potential command execution. This occurs because the native storage allocated for one frame is retained and reused for a later frame with a different mode without proper validation. Affected image formats include PSD, MPO/JPEG, DCX, and MIC. The vulnerability allows denial of service and, in some cases, command execution in specific runtime profiles. The issue was confirmed in Pillow 12.3.0.