Is CVE-2026-96642 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96642 being exploited in the wild.

How severe is CVE-2026-96642?

High severity, with a CVSS score of 4, published 21 October 2026.

Which products and versions are affected?

pillow (PyPI) < 13.0.0, ECOSYSTEM:introduced=0,fixed=13.0.0; Python Pillow Pillow prior to 13.0.0.

Is there a fix for CVE-2026-96642?

Yes. pillow (PyPI): upgrade to 13.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-96642 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-96642?

Check whether you run pillow (PyPI) or Python Pillow Pillow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96642: Pillow infinite loop in TarIO with negative octal member size

Q: Which products and versions are affected?

pillow (PyPI) < 13.0.0, ECOSYSTEM:introduced=0,fixed=13.0.0; Python Pillow Pillow prior to 13.0.0.

Q: Is there a fix for CVE-2026-96642?

Yes. pillow (PyPI): upgrade to 13.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-96642 attacked?

It is attacked over the network or with local access, in a software library.

Q: Am I affected by CVE-2026-96642?

Check whether you run pillow (PyPI) or Python Pillow Pillow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96642 · Severity: high · CVSS 4 · Published 2026-10-21

Pillow is a Python library for image processing. When an application directly uses the TarIO module to read TAR archive files, a specially crafted TAR file with a negative octal member size can cause the parser to enter an infinite loop, consuming a full CPU core and freezing the application until it is forced to shut down.

Technologies: pillow (PyPI), Python Pillow Pillow. Vendors: PyPI, Python Pillow.

Quick answers

Is CVE-2026-96642 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96642 being exploited in the wild.
How severe is CVE-2026-96642?: High severity, with a CVSS score of 4, published 21 October 2026.
Which products and versions are affected?: pillow (PyPI) < 13.0.0, ECOSYSTEM:introduced=0,fixed=13.0.0; Python Pillow Pillow prior to 13.0.0.
Is there a fix for CVE-2026-96642?: Yes. pillow (PyPI): upgrade to 13.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96642 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-96642?: Check whether you run pillow (PyPI) or Python Pillow Pillow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pillow (PyPI): upgrade to 13.0.0 or later
```
pip install "pillow>=13.0.0"
```

Technical details

The TarIO initializer in src/PIL/TarIO.py accepts negative octal member sizes and computes a backward seek operation that returns to the same 512-byte TAR header. When the requested member name does not match, the parser loops indefinitely re-reading the same header. The vulnerability requires direct use of PIL.TarIO.TarIO; the default Image.open() path is not affected.

Affected products

python-pillow Pillow prior to 13.0.0

Identifiers

CVE-2026-96642
BIT-PILLOW-2026-96642
GHSA-3j72-p6qg-6xp7
PYSEC-2026-4341

Timeline

2026-10-21: disclosed
2026-09-17: patched: Commit 19b695f merged to main

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.