Tetrak
GitHub ↗
Security · Pillow

A PILfont's negative glyph advance makes a signed integer wrap

Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise

Advisory
CVE-2026-96641
Library
Pillow, pillow on PyPI
Published
Severity
6.5 out of 10, as published
Affected
12.3.0
Fixed in
13.0.0
Reaches you
through another call

What triggers it

Measuring text with a crafted PILfont through ImageFont.

What sillybos does

Refused by default

sillybos refuses the triggering file under its default policy, through the format check.

The carrier is a PILfont, Pillow's own bitmap font format, whose glyph advance is a signed 16-bit field; a crafted one carries -32,768 and a string of 65,537 characters measured with it wraps the width. Handed to the check, its first bytes are not one of the four formats a scan can be and it is refused as unknown, so the record claims that refusal, though a font is a program's asset that no image check is usually in front of. Neither Tetrak OCR nor sillybos imports ImageFont. Pillow 13.0.0 raises OverflowError instead; on an older Pillow a width above the characters measured times 32,767 is the wrapped value.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Checked on 2026-11-03: the carrier is a font file, not an image. The fix is present in 13.0.0, checked with the advisory's reproducer on 2026-11-03; the first release carrying it was not confirmed. Re-bucketed on 2026-11-03: the file that carries the trigger is one the check refuses, so the record claims it.

Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:

How to protect yourself

In general. Upgrade to Pillow 13.0.0, which raises OverflowError ("Width too small") where 12.3.0 returned a wrapped width.

Specifically. Load only fonts you ship, never a font from outside; and if a file from outside could be one, run the check on it: a font is refused as unknown.

The general advice applies to every row here.

Sources