CVE-2026-96778

Name of the Vulnerable Software and Affected Versions Pillow versions 9.4.0 through 12.x

Description The ImagingJpegEncode() function in src/libImaging/JpegEncode.c can call jpeg write marker() for a JPEG COM comment when an ICC profile exactly fills the 65536-byte encoder buffer. This causes libjpeg to write one byte before checking the free in buffer counter, which then wraps and allows an attacker-controlled comment and compressed image data to overwrite adjacent heap memory. Re-saving an untrusted image as JPEG while preserving its ICC profile and forwarded comment can lead to a process crash or potential code execution depending on the runtime and heap layouts.

Recommendations Update to version 13.0.0.