CVE WATCH / VULNERABILITY DETAIL
CVE-2026-96636
MEDIUMCVSS 6.5NVD feed
Published 21 October 2026 · tracked since 22 October 2026
Description
Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DCX frames and replace self._size without rerunning Image._decompression_bomb_check(). A crafted multi-frame image can use a tiny first frame to pass Image.open() and then declare an
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-54630 CRITICAL 9.6
- CVE-2026-54631 MEDIUM 6.3
- CVE-2026-19678
- CVE-2026-115536 MEDIUM 4.3
- CVE-2026-115537 MEDIUM 4.3
- CVE-2026-115535 LOW 2.4
- CVE-2026-115534 MEDIUM 4.3
- CVE-2026-114625
- CVE-2026-83938 CRITICAL 10
- CVE-2026-114620 MEDIUM 5.4