pillow: pillow: Arbitrary code execution via JPEG encoder buffer overflow (CVE-2026-96778)

Overview

A flaw was found in Pillow. A remote attacker could exploit a heap buffer overflow vulnerability to achieve arbitrary code execution or cause a Denial of Service (DoS). This issue occurs when an application re-encodes an untrusted image into JPEG format while preserving specially crafted color profile and comment metadata, causing an internal memory buffer to overflow. Successful exploitation allows adjacent memory to be overwritten, which can crash the application or permit code execution in suitable runtime environments.

Vendor advisories

• Red Hat VEX · Important · affected: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 8, … · no fix planned: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, … · updated 2026-10-23 · vex

pillow: pillow: Arbitrary code execution via JPEG encoder buffer overflow — rated Important by Red Hat. Released 2026-10-21, updated 2026-10-23.

Affected:

• Exploit Intelligence
• Lightspeed Core
• OpenShift Lightspeed
• Red Hat AI Inference Server
• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux AI (RHEL AI) 3
• Red Hat Lightspeed Services for OCP
• Red Hat OpenShift AI (RHOAI)
• Red Hat Quay 3
• Red Hat Satellite 6

No fix planned:

• Exploit Intelligence
• Lightspeed Core
• OpenShift Lightspeed
• Red Hat AI Inference Server
• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux AI (RHEL AI) 3
• Red Hat Lightspeed Services for OCP
• Red Hat OpenShift AI (RHOAI)
• Red Hat Quay 3
• Red Hat Satellite 6

Not affected:

• Red Hat Ansible Automation Platform 2
• Red Hat OpenShift AI (RHOAI)

Remediation

Affected

Workarounds / mitigations:

• Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Package advisory (CVE-2026-96778)

Affected packages:

• pillow >= 9.4.0, < 13.0.0

Patched in:

• pillow 13.0.0

Source: https://osv.dev/vulnerability/GHSA-g7cr-3p24-7wf7