PatchTheCVECVE-2026-96638: Pillow is a Python imaging library
CVE-2026-96638 is a medium-severity flaw (CVSS 6.5) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining dest_length without a per-branch cap. A delta can add roughly 255 image rows in one iteration, so a kilobyte-sized file with a large but permitted width can expand the data bytearray to hundreds of megabytes or more, causing memory-exhaustion de
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Last updated 2026-10-22 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-96638?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-96638 being exploited?
CVE-2026-96638 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-96638 affect?
CVE-2026-96638 affects affected software. Severity is medium (CVSS 6.5). Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining dest_length without a per-branch ca
How urgent is CVE-2026-96638?
Priority 28/100. No elevated risk signals yet.