PyPI/pillow CVE-2026-96778: high 7.7

Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer

Action: Upgrade pillow to 13.0.0 or later.

pip install pillow==13.0.0

Affected

Fixed versions

Sources

• osv: GHSA-g7cr-3p24-7wf7
• nvd: CVE-2026-96778
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-g7cr-3p24-7wf7
• https://github.com/python-pillow/Pillow/pull/10124
• https://github.com/python-pillow/Pillow/commit/02561b8dc6117d5670d4b469fecdd02c70854f9b
• https://github.com/python-pillow/Pillow
• https://github.com/python-pillow/Pillow/releases/tag/13.0.0

CVE-2026-96778 · published 2026-10-22T16:05:39Z · modified 2026-10-22T16:15:47.504236729Z · JSON