PyPI/pillow CVE-2026-96642: high 7.1, EPSS 0.33%

Pillow: TarIO negative size field causes infinite CPU-spin loop

Action: Upgrade pillow to 13.0.0 or later.

pip install pillow==13.0.0

Affected

Fixed versions

Sources

• osv: GHSA-3j72-p6qg-6xp7
• nvd: CVE-2026-96642
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-3j72-p6qg-6xp7
• https://github.com/python-pillow/Pillow/pull/10012
• https://github.com/python-pillow/Pillow/commit/19b695fdcc5eddc37374e2b1645fc4185edaf71d
• https://github.com/python-pillow/Pillow
• https://github.com/python-pillow/Pillow/releases/tag/13.0.0

CVE-2026-96642 · published 2026-10-22T16:01:46Z · modified 2026-10-22T16:15:47.141565966Z · JSON