Pillow 13.0.0 Fixes High-Severity Decompression Bomb Bypass in Spider Plugin
Python image library Pillow releases version 13.0.0 to address CVE-2026-96637, a high-severity flaw allowing unbounded memory allocation via crafted SPIDER files.
Key points
- Pillow versions prior to 13.0.0 are vulnerable to CVE-2026-96637, a high-severity issue.
- The flaw allows tiny SPIDER stack files to trigger multi-gigabyte memory allocations.
- Version 13.0.0 is the first patched release; earlier versions remain exposed.
Pillow version 13.0.0 resolves a high-severity vulnerability identified as CVE-2026-96637. This update addresses a flaw in the SpiderImagePlugin that permits unbounded memory allocation through crafted image files.
What happened
The vulnerability exists in all Pillow versions prior to 13.0.0, including development builds up to commit e7a7ea84. According to GitHub advisory GHSA-g842-9rc4-69pw, the SpiderImagePlugin’s seek method bypasses the standard decompression bomb check. A crafted SPIDER stack file smaller than one kilobyte can trigger a multi-gigabyte memory allocation when im.load() is called.
The root cause involves how Image.open() handles multi-frame files. The initial call runs a decompression bomb check once, but SpiderImageFile.seek() calls _open() directly again. This secondary call re-parses header floats without validation and reassigns the image size. No bomb check runs on this new, attacker-influenced size.
During the subsequent load operation, ImageFile.load_prepare() creates a new image buffer using the unchecked size. Because the mode is fixed at "F" (four bytes per pixel), a large dimension like 40000x40000 results in a 6.4 GB allocation. This path bypasses the single pixel-bomb check normally enforced by Image.open().
Why it matters
This flaw represents a significant deviation from how other multi-frame plugins handle security. According to the advisory, GifImagePlugin, TiffImagePlugin, IcnsImagePlugin, and IcoImagePlugin all re-run decompression checks during seek or sub-image selection. SpiderImagePlugin lacked any such check, leaving it vulnerable to the same class of bug recently fixed in GdImageFile and FontFile classes.
The issue allows an attacker to influence memory consumption independently of the global pixel limit. Since the allocation occurs on a non-Image.open() path, standard safeguards are ineffective. This makes the vulnerability particularly dangerous for applications that process untrusted SPIDER files without strict external validation.
What to watch
- Monitor for Python applications that accept SPIDER image files from untrusted sources.
- Check if any internal tools use Pillow versions older than 13.0.0 for image processing.
- Review logs for sudden spikes in memory usage during image loading operations.
- Verify that decompression bomb checks are enforced across all image plugin paths.
Who needs to act first
Teams should prioritize updating systems that process images from external or untrusted sources. Since this flaw allows massive memory allocation, exposed web services face immediate risk. Before rolling out the fix, test the update in a staging environment to ensure compatibility with existing image workflows. Back up configuration files and dependencies before making changes. If immediate patching is not possible, restrict input to trusted sources only and monitor memory usage closely for signs of exploitation.
What to do and how to stay safe: Pillow
- Upgrade all instances of the Pillow package to version 13.0.0 or later to apply the fix.
- Audit applications to identify any that load SPIDER format images from user uploads.
- Implement strict file size limits at the application layer before passing files to the library.
- Monitor system memory usage for anomalies that could indicate exploitation attempts.
Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks
General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Pillow are affected by CVE-2026-96637?
All versions prior to 13.0.0, including development builds up to v13.0.0.dev0, are vulnerable.
Is there a confirmed fix for this vulnerability?
Yes, version 13.0.0 of Pillow patches the issue by addressing the bypass in the SpiderImagePlugin.
How does the vulnerability allow for large memory allocations?
The seek method bypasses the decompression bomb check, allowing attacker-controlled header values to dictate buffer size during load.
