CVE-2026-96778

{
  "etk_id": "ETK-2026-2174",
  "cve_id": "CVE-2026-96778",
  "display_id": "CVE-2026-96778",
  "ghsa_id": "GHSA-g7cr-3p24-7wf7",
  "euvd_id": "EUVD-2026-107566",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Heap buffer overflow in Pillow JPEG encoding",
  "summary": "Pillow versions 9.4.0 through 12.x can overflow a heap buffer while re-encoding an image as JPEG. An attacker who can supply an image may crash the processing Python process and could potentially achieve code execution if the application preserves the image's ICC profile and comment during JPEG output.",
  "mitigation": "Upgrade Pillow to version 13.0.0 or later. Until upgrades are complete, avoid re-saving untrusted images as JPEG while retaining embedded ICC profiles or comment metadata.",
  "vendor": "pip",
  "product": "Pillow",
  "affected": [
    {
      "affected_notes": [
        "9.4.0 - 12.3.0"
      ],
      "affected_ranges": [],
      "ecosystem": "pip",
      "fixed_versions": [
        "13.0.0"
      ],
      "package_name": "Pillow",
      "purl": "pkg:pypi/Pillow"
    }
  ],
  "cwes": [
    787
  ],
  "cvss_score": 7.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 10.295919866666667,
  "t0_at": "2026-10-21T20:58:24.238000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-17T10:35:22+00:00",
      "days": -4.432664791666666,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T20:58:24.238000+00:00",
      "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-g7cr-3p24-7wf7"
    }
  }
}