{"action":"Upgrade pillow to 13.0.0 or later.","affected":[{"fixed":"13.0.0","introduced":"0"}],"component":"pillow","cve_ids":["CVE-2026-96644"],"ecosystem":"PyPI","epss":0.00412,"exploited":false,"fixed_versions":["13.0.0"],"ghsa_id":"GHSA-9v9v-9qvf-h2hj","id":"tcs_01M5JMCHTKN04HVCJ6QHZN9EVK","modified_at":"2026-10-22T16:15:47.507449856Z","published_at":"2026-10-22T16:03:14Z","references":["https://osv.dev/vulnerability/GHSA-9v9v-9qvf-h2hj","https://github.com/python-pillow/Pillow/security/advisories/GHSA-9v9v-9qvf-h2hj","https://nvd.nist.gov/vuln/detail/CVE-2026-96644","https://github.com/python-pillow/Pillow/pull/10120","https://github.com/python-pillow/Pillow/commit/4cf46bee338304c5c8968fd7f132ba0d40c428b7","https://github.com/python-pillow/Pillow","https://github.com/python-pillow/Pillow/releases/tag/13.0.0"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-9v9v-9qvf-h2hj","url":"https://osv.dev/vulnerability/GHSA-9v9v-9qvf-h2hj"},{"source":"nvd","source_id":"CVE-2026-96644","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96644"}],"summary":"Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)"}