Bug 2558570 (CVE-2026-96644)

Summary:	CVE-2026-96644 pillow: Pillow: Denial of Service via out-of-bounds read in metafile parser
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	alinfoot, anpicker, anthomas, aprice, bbrownin, cmyers, dfreiber, dnakabaa, doconnor, drow, dschmidt, dtrifiro, ebourniv, ehelms, ggainey, hasun, ilpinto, jburrell, jfula, jlanda, jmitchel, jowilson, jpasqual, jsamir, juwatts, jwong, kaycoth, kshier, lcouzens, ltomasbo, mdellweg, mhayden, mhulan, mwoodson, nmoumoul, nyancey, oezr, omaciel, ometelka, osousa, pcreech, ptisnovs, rbobbitt, rchan, rhel-process-autobot, sbunciak, sdoran, simaishi, smallamp, stcannon, syedriko, tmalecek, vkumar, watson-tool-maintainers, weaton, xdharmai, yguenane, ykashtan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Pillow. When processing Windows Metafile (WMF) or Enhanced Metafile (EMF) images on Windows systems, the image parser improperly handles dimension values, allocating an undersized buffer while reading full dimensions. A remote attacker could exploit this vulnerability by enticing an application or user to process a specially crafted metafile, triggering an out-of-bounds memory read that results in a Denial of Service (DoS) via an application crash or potential information disclosure.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-21 21:11:16 UTC

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using the original full dimensions. A crafted wide, short metafile can pass the pixel-count decompression-bomb check and make the Windows-only renderer read beyond the heap buffer, potentially disclosing memory or crashing the process. This issue is fixed in version 13.0.0.