A kilobyte BMP makes Pillow's run-length decoder allocate gigabytes
Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
- Advisory
- CVE-2026-96638
- Library
- Pillow, pillow on PyPI
- Published
- Severity
- 6.5 out of 10, as published
- Affected
- <= 13.0.0
- Fixed in
- see the upstream record
- Reaches you
- by opening a file
What triggers it
Image.open and load on a crafted run-length-encoded BMP.
What sillybos does
Refused by default
sillybos refuses the triggering file under its default policy, through the format check.
A BMP is not one of the four formats a scan can be and is refused by name before Pillow sees it.
Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.
Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:
How to protect yourself
In general. Upgrade Pillow to a version that has the fix; the upstream record names it.
Specifically. Open with formats limited to the readers you mean to use, as open_checked does; a file of any other format is refused before Pillow sees it.
The general advice applies to every row here.
Sources
- https://osv.dev/vulnerability/GHSA-24rc-8hj2-v98c
- The record entry, triaged 2026-11-03, last checked 2026-11-03