CVE-2026-96644

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0

Description On Windows, the src/PIL/WmfImagePlugin.py component passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf() handler in src/display.c. The handler determines the size of a Device Independent Bitmap (DIB) allocation using 16-bit-truncated bcWidth and bcHeight fields, but subsequently copies pixel data using the original full dimensions. A specially crafted wide and short metafile can bypass the pixel-count decompression-bomb check, causing the renderer to read beyond the heap buffer, which may lead to memory disclosure or a process crash.

Recommendations Update to version 13.0.0.