CVE-2026-96643 - Vulnerability Details

- Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time

Description

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new shrinking copy on every iteration and quadratic CPU work. The condition is reachable through Image.getexif(), Image._getexif(), and ImageOps.exif_transpose(), including common photo-upload rotation workflows. This issue is fixed in version 13.0.0.

Published: 2026-10-21

Score: 7.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Pillow’s EXIF parsing routine processes the PNG eXIf chunk in a way that causes a quadratic‑time copy operation for each repeated Exif header. A crafted PNG containing many header repeats forces the library to copy shrinking chunks repeatedly, resulting in excessive CPU usage and a denial of service. The vulnerability does not provide direct code execution or privilege escalation; its impact is limited to disrupting service availability.

Affected Systems

The flaw affects Python Pillow versions 11.0.0 through 12.x.x, inclusive. All products that depend on these releases for image processing, such as web applications that upload or manipulate PNG files, are potentially impacted.

Risk and Exploitability

The CVSS score of 7.1 reflects a high impact, while the EPSS score of 0.00333 (0.333%) indicates a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Attackers can exploit the weakness by supplying a malicious PNG file—either via a local file upload, a remote web endpoint, or any automated image ingestion process that uses Pillow’s EXIF handling. The likely attack vector is through application‑level image upload workflows where end users submit pictures.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

python-pillow

Pillow

affected

Version	Status	Constraints
`>= 11.0.0, < 13.0.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions

Python-pillow

Pillow

100%

Version	Status	Scheme	Platform
`[11.0.0,13.0.0)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Pillow to version 13.0.0 or later, which contains the fix.
If upgrading is not immediately possible, apply the patch commit 806e38381c781f32bbd22f4cd026678acd40fd6c to your current Pillow installation.
Implement input validation to reject or truncate PNG eXIf chunks that exceed reasonable sizes before processing with Pillow to mitigate the CPU exhaustion risk.

Generated by OpenCVE AI on October 22, 2026 at 15:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Github GHSA	GHSA-g4qv-2jxx-769h	Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00373.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/python-pillow/Pillow/commit/806e38381c781f32bbd22f4cd026678acd40fd6c
https://github.com/python-pillow/Pillow/pull/10073
https://github.com/python-pillow/Pillow/releases/tag/13.0.0
https://github.com/python-pillow/Pillow/security/advisories/GHSA-g4qv-2jxx-769h
https://nvd.nist.gov/vuln/detail/CVE-2026-96643
https://www.cve.org/CVERecord?id=CVE-2026-96643

History

Tue, 27 Oct 2026 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Python Python pillow
CPEs		cpe:2.3:a:python:pillow::::::::
Vendors & Products		Python Python pillow
Metrics	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}`

Fri, 23 Oct 2026 22:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 22 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-606
References		https://nvd.nist.gov/vuln/detail/CVE-2026-96643 https://www.cve.org/CVERecord?id=CVE-2026-96643
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Thu, 22 Oct 2026 04:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Python-pillow Python-pillow pillow
Vendors & Products		Python-pillow Python-pillow pillow

Wed, 21 Oct 2026 21:00:00 +0000

Type	Values Removed	Values Added
Description		Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new shrinking copy on every iteration and quadratic CPU work. The condition is reachable through Image.getexif(), Image._getexif(), and ImageOps.exif_transpose(), including common photo-upload rotation workflows. This issue is fixed in version 13.0.0.
Title		Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
Weaknesses		CWE-407
References		https://github.com/python-pillow/Pillow/commit/806e38381c781f32bbd22f4cd026678acd40fd6c https://github.com/python-pillow/Pillow/pull/10073 https://github.com/python-pillow/Pillow/releases/tag/13.0.0 https://github.com/python-pillow/Pillow/security/advisories/GHSA-g4qv-2jxx-769h
Metrics		cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Python Pillow

Python-pillow Pillow

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-10-21T20:56:26.344Z

Updated: 2026-10-23T21:19:12.901Z

Reserved: 2026-09-23T14:35:50.130Z

Link: CVE-2026-96643

Vulnrichment

Updated: 2026-10-23T17:32:49.817Z

NVD

Status : Analyzed

Published: 2026-10-21T21:20:32.797

Modified: 2026-10-27T14:26:51.563

Link: CVE-2026-96643

Redhat

Severity : Important

Publid Date: 2026-10-21T20:56:26Z

Links: CVE-2026-96643 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-22T16:00:11Z

Weaknesses

CWE-407
Inefficient Algorithmic Complexity
CWE-606
Unchecked Input for Loop Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object