Tetrak
GitHub ↗
Security · Pillow

A JPEG comment after a full ICC profile overflows Pillow's JPEG encoder

Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer

Advisory
CVE-2026-96778
Library
Pillow, pillow on PyPI
Published
Severity
not scored upstream
Affected
< 12.3.0
Fixed in
12.3.0
Reaches you
on a save path

What triggers it

Image.save(format="JPEG") of an image carrying a large ICC profile and a comment.

What sillybos does

Refused with a setting

sillybos refuses the triggering file when the policy says so (Policy(max_metadata_bytes=65_000)); the default policy lets it through.

The comment rides from the opened file into a JPEG save on its own, and the profile does when the program passes it, which is the documented way to keep colour. The profile has to fill the encoder's 64 KB buffer, so it is about 65,498 bytes, and it is the block the reader measures: the default ceiling of 4 MiB lets it through, and a ceiling under 65 KB refuses the file. Tetrak OCR's access copy does not pass the profile, so it is not reached there.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Re-read on 2026-11-03 against the question of what rides from an opened file into a save: the file is the input.

Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:

How to protect yourself

In general. Upgrade to Pillow 12.3.0.

Specifically. Set max_metadata_bytes under 65 KB where no colour profile that large has a use, or do not pass icc_profile when re-saving a file from outside; upgrade to Pillow 12.3.0.

The general advice applies to every row here.

Sources