CVE-2026-96778 python-pillow CVE debrief

Who should care

Defenders responsible for image processing systems, especially those using Pillow for JPEG encoding, should assess exposure and prioritize updates or compensating controls. This includes reviewing relevant monitoring, detection, and logs for exposed assets that need extra review, and tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented.

Why it matters

CVE-2026-96778 is a heap buffer overflow in Pillow's JPEG encoder that can lead to process crashes and potentially code execution. Defenders should prioritize verifying exposure, especially in image processing workflows using affected Pillow versions, and update to version 13.0.0 or later.

• Potential code execution due to overwritten function pointers
• Reliable process crash when handling specially crafted images
• Need for verification of exposure in image processing workflows
• Priority on updating or patching affected Pillow versions

Technical summary

The bug is in ImagingJpegEncode() in src/libImaging/JpegEncode.c. State 4 (line 330) calls jpeg_write_marker() for the COM comment marker without checking that the output buffer has room. This allows writing up to 64 KB of chosen bytes past a 64 KB heap buffer when saving an image as JPEG with its color profile. The reliable result is that the Python process is killed outright rather than raising an exception. Because the overwritten memory sits directly in front of function pointers that the encoder calls next, this could allow code execution, though the attached reproducer demonstrates only the crash.

Defensive priority

Defenders should prioritize verifying exposure in image processing workflows, especially where untrusted images are re-saved as JPEG. Assess Pillow versions 9.4.0 to 12.3.0 for potential vulnerability.

Recommended defensive actions

• Verify and update Pillow to version 13.0.0 or later
• Assess exposure in image processing workflows using affected Pillow versions
• Implement compensating controls for untrusted image processing
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The issue is confirmed in Pillow's JPEG encoder, specifically in ImagingJpegEncode() at src/libImaging/JpegEncode.c:330. A reproducer demonstrates the crash, but code execution is speculative. The reliable result is that the Python process is killed outright rather than raising an exception. Because the overwritten memory sits directly in front of function pointers that the encoder calls next, this could allow code execution, though the attached reproducer demonstrates only the crash.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.