Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new shrinking copy on every iteration and quadratic CPU work. The condition is reachable through Image.getexif(), Image._getexif(), and ImageOps.exif_transpose(), including common photo-upload rotation workflows. This issue is fixed in version 13.0.0.
References
Configurations
History
27 Oct 2026, 14:26
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* | |
| References | () https://github.com/python-pillow/Pillow/commit/806e38381c781f32bbd22f4cd026678acd40fd6c - Patch | |
| References | () https://github.com/python-pillow/Pillow/pull/10073 - Issue Tracking | |
| References | () https://github.com/python-pillow/Pillow/releases/tag/13.0.0 - Release Notes | |
| References | () https://github.com/python-pillow/Pillow/security/advisories/GHSA-g4qv-2jxx-769h - Vendor Advisory | |
| First Time |
Python
Python pillow |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
21 Oct 2026, 21:20
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-21 21:20
Updated : 2026-10-27 14:26
NVD link : CVE-2026-96643
Mitre link : CVE-2026-96643
CVE.ORG link : CVE-2026-96643
JSON object : View
Products Affected
python
- pillow
CWE
CWE-407
Inefficient Algorithmic Complexity