Is CVE-2026-96641 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96641 being exploited in the wild.

How severe is CVE-2026-96641?

Medium severity, with a CVSS score of 6.5, published 21 October 2026.

Which products and versions are affected?

pillow (PyPI) < 13.0.0, ECOSYSTEM:introduced=0,fixed=13.0.0; Python Pillow Pillow prior to 13.0.0.

Is there a fix for CVE-2026-96641?

Yes. pillow (PyPI): upgrade to 13.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-96641 attacked?

It is attacked over the network or with local access.

Am I affected by CVE-2026-96641?

Check whether you run pillow (PyPI) or Python Pillow Pillow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96641: Pillow signed integer overflow in PILfont text-width accumulation

Q: Which products and versions are affected?

pillow (PyPI) < 13.0.0, ECOSYSTEM:introduced=0,fixed=13.0.0; Python Pillow Pillow prior to 13.0.0.

Q: Is there a fix for CVE-2026-96641?

Yes. pillow (PyPI): upgrade to 13.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-96641 attacked?

It is attacked over the network or with local access.

Q: Am I affected by CVE-2026-96641?

Check whether you run pillow (PyPI) or Python Pillow Pillow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96641 · Severity: medium · CVSS 6.5 · Published 2026-10-21

Pillow is a widely-used Python library for image processing used in web applications and content management systems. A flaw in its text measurement functions can cause integer overflow when processing specially crafted font files with negative glyph advances, leading to incorrect width calculations that may result in memory exhaustion, incorrect image sizing, or bypassed resource limits.

Technologies: pillow (PyPI), Python Pillow Pillow. Vendors: PyPI, Python Pillow.

Quick answers

Is CVE-2026-96641 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96641 being exploited in the wild.
How severe is CVE-2026-96641?: Medium severity, with a CVSS score of 6.5, published 21 October 2026.
Which products and versions are affected?: pillow (PyPI) < 13.0.0, ECOSYSTEM:introduced=0,fixed=13.0.0; Python Pillow Pillow prior to 13.0.0.
Is there a fix for CVE-2026-96641?: Yes. pillow (PyPI): upgrade to 13.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96641 attacked?: It is attacked over the network or with local access.
Am I affected by CVE-2026-96641?: Check whether you run pillow (PyPI) or Python Pillow Pillow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pillow (PyPI): upgrade to 13.0.0 or later
```
pip install "pillow>=13.0.0"
```

Technical details

The vulnerability is a signed integer overflow in src/_imaging.c's text-width accumulation logic. The code validates positive glyph advances against INT_MAX but fails to check negative advances against INT_MIN; repeating a -32768 advance causes signed overflow in the xsize accumulator, wrapping to a large positive value. This affects getlength(), getsize(), and downstream layout, quota, serialization, and allocation functions that rely on these measurements, though the high-level mask code path retains a decompression-bomb check.

Affected products

Python Pillow Pillow prior to 13.0.0

Identifiers

CVE-2026-96641
BIT-PILLOW-2026-96641
GHSA-4rm8-3hmm-39fg
PYSEC-2026-4340

Timeline

2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.