CVE-2026-96778 — Pillow: Heap buffer overflow when writing a JPEG comment after an ICC profile fills the buffer

Pillow’s JPEG encoder contains a heap buffer overflow. A specially crafted JPEG or PNG can cause an application that re-saves the image as JPEG while preserving its ICC profile to write beyond a 64 KiB heap buffer. The source reproducer causes the Python process to terminate with SIGSEGV or a glibc heap-consistency error.