Pillow 13.0.0 Patch Stops JPEG ICC Profile Heap Overflow Crashes and Code Execution Risks

A heap buffer overflow in the Pillow image library allows attackers to write data past allocated memory limits. This vulnerability, tracked as CVE-2026-96778, affects applications that resave JPEG images while preserving colour profiles.

What happened

The vulnerability exists within the `ImagingJpegEncode` function in the `JpegEncode.c` source file of the Pillow library. According to the GitHub advisory GHSA-g7cr-3p24-7wf7, the flaw is rated as high severity. It occurs when the encoder processes a JPEG comment marker without verifying if the output buffer has sufficient space.

The buffer size is calculated based on EXIF and ICC or XMP data alone. The code does not reserve any additional space for the comment marker itself. When an ICC profile of exactly 65,498 bytes fills the 65,536-byte buffer, the subsequent write operation exceeds the allocated memory boundary.

This overflow allows an attacker to write up to 64 kilobytes of chosen bytes. These bytes are followed by the remainder of the compressed image data. The write occurs past the end of the 64-kilobyte heap buffer designated for the operation.

Triggering the bug requires only a valid JPEG or PNG file containing the specific profile and any comment. The file is processed through standard Pillow methods like `Image.open` and `im.save`. No non-default settings are required to exploit this behavior.

Why it matters

The primary observed result of this overflow is that the Python process terminates abruptly. The process dies with a SIGSEGV signal rather than raising a manageable exception. This behavior indicates a denial-of-service condition for any application relying on Pillow for image processing.

Because the overwritten memory sits directly in front of function pointers, the overflow could allow code execution. The encoder calls these pointers immediately after the write operation. Although the attached reproducer demonstrates only the crash, the memory layout suggests remote code execution is possible.

Any application that resaves images as JPEG while keeping their colour profile is a target. This is a common workflow in web applications and image editing tools. The documented way to preserve colour in Pillow automatically forwards comments from the image info.

Our take on the response

• Upgrade Pillow to version 13.0.0 immediately to apply the fix for CVE-2026-96778.
• Audit applications that process user-supplied images to ensure they use patched library versions.
• Monitor logs for unexpected process terminations or SIGSEGV signals in image processing services.
• Review input validation for image files to detect unusual ICC profile sizes or comments.

What defenders should look for

Teams usually detect this activity by monitoring for unexpected application crashes in services handling image uploads. Check whether image processing containers or services are restarting frequently without clear cause. Look for segmentation fault signals in system logs associated with Python processes. Verify that the Pillow library version matches the patched release. Ensure that image processing workers are isolated to limit blast radius. Monitor for anomalous memory access patterns in debug logs if available. Confirm that no user-supplied images contain oversized metadata fields. Review access logs for repeated failed processing attempts. Validate that application error handling does not expose stack traces.

Ensure that image processing services run with least privilege. Check that network segmentation limits lateral movement from compromised image services. Verify that backup systems are not affected by the same vulnerability. Monitor for unusual outbound connections from image processing hosts. Ensure that audit logs capture image metadata changes. Validate that rate limiting is applied to image upload endpoints. Check that file type validation occurs before processing. Ensure that temporary files are cleaned up securely. Monitor for signs of shellcode execution in memory dumps. Verify that security patches are applied promptly. Check that vendor advisories are reviewed regularly. Ensure that incident response plans cover image processing vulnerabilities.

Background: Lateral movement

Lateral movement is the process where an attacker navigates from one system to another within a network after initial access. They use stolen credentials or unpatched vulnerabilities to expand their reach. This tactic allows them to reach sensitive data or critical servers without triggering perimeter alarms, making internal monitoring the primary defense.

Read the full guide: Lateral Movement in Cybersecurity: Definition and Detection

What to do and how to stay safe: Pillow

• Update the Pillow library to version 13.0.0 or later in all affected environments.
• Restrict image processing services to handle only trusted inputs where possible.
• Implement robust error handling to catch and log unexpected process terminations.
• Monitor application logs for SIGSEGV signals or segmentation faults in Python processes.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Pillow are vulnerable to CVE-2026-96778?

Pillow versions from 9.4.0 up to, but not including, 13.0.0 are vulnerable to this heap buffer overflow.

Is there a patch available for this vulnerability?

Yes, the vulnerability is fixed in Pillow version 13.0.0, which is available via pip.

What is the severity rating for CVE-2026-96778?

The GitHub advisory rates CVE-2026-96778 as high severity due to the potential for code execution.