CERT24CVE-2026-96636 — Pillow decompression-bomb protection bypass via multi-frame seek() in MPO and DCXLoading data…
CERT24Threat Observatory
Period

CVE-2026-96636 — Pillow decompression-bomb protection bypass via multi-frame seek() in MPO and DCX

Pillow’s decompression-bomb protection checks only the first frame by default. In MPO and DCX files, a later frame with extremely large dimensions can bypass the check, and loading it can exhaust memory or terminate the process due to OOM.

← Back to intelligence

CVE-2026-96636 — Pillow decompression-bomb protection bypass via multi-frame seek() in MPO and DCX

Pillow’s decompression-bomb protection checks only the first frame by default. In MPO and DCX files, a later frame with extremely large dimensions can bypass the check, and loading it can exhaust memory or terminate the process due to OOM.