A wide, short metafile over-reads the heap in Pillow's Windows renderer

Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)

Advisory

CVE-2026-96644

Library

Pillow, pillow on PyPI

Published

2026-10-21

Severity

not scored upstream

Affected

< 12.3.0

Fixed in

12.3.0

Reaches you

by opening a file

What triggers it

Image.open and load on a crafted WMF or EMF file on a Windows build of Pillow.

What sillybos does

Refused by default

sillybos refuses the triggering file under its default policy, through the format check.

A Windows metafile is not one of the four formats a scan can be and is refused before Pillow sees it.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.

Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:

• tests/test_check.py::TestHostileFiles::test_an_unknown_format

How to protect yourself

In general. Upgrade to Pillow 12.3.0.

Specifically. Open with formats limited to the readers you mean to use, as open_checked does; a file of any other format is refused before Pillow sees it.

The general advice applies to every row here.

Sources

• https://osv.dev/vulnerability/GHSA-9v9v-9qvf-h2hj
• https://osv.dev/vulnerability/PYSEC-2026-4343
• The record entry, triaged 2026-11-03, last checked 2026-11-03