{"schemaVersion":3,"id":"CVE-2026-96641","aliases":["DEBIAN-CVE-2026-96641"],"status":"published","duplicateOf":null,"title":null,"description":"Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/_imaging.c checks positive glyph advances against INT_MAX but does not check negative advances against INT_MIN. Repeating a signed 16-bit advance of -32768 can therefore execute a signed C integer overflow in xsize += dx, producing a large positive width from a negative mathematical result. Applications that use getlength(), getsize(), or derived layout, quota, serialization, or allocation calculations can experience logic-integrity errors or resource consumption, while the high-level mask path commonly retains a decompression-bomb check. This issue is fixed in version 13.0.0.","dates":{"published":"2026-10-21T20:51:24.388Z","modified":"2026-10-21T20:51:24.388Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.5,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-190","name":"Integer Overflow or Wraparound","description":"The product performs a calculation that can\n         produce an integer overflow or wraparound when the logic\n         assumes that the resulting value will always be larger than\n         the original value. This occurs when an integer value is\n         incremented to a value that is too large to store in the\n         associated representation. When this occurs, the value may\n         become a very small or negative number.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/190.html"}],"affected":[{"vendor":"debian","product":"pillow","name":"pillow","label":"pillow","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/pillow","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"python-pillow","product":"pillow","name":"Pillow","label":"pillow","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 13.0.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 13.0.0","eol":null,"hubHref":"/vendor/python-pillow/pillow"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-4rm8-3hmm-39fg","label":"github.com/python-pillow/Pillow/security/advisories/GHSA-4rm8-3hmm-39fg","hostname":"github.com","tags":["X Refsource CONFIRM"]},{"url":"https://github.com/python-pillow/Pillow/pull/10010","label":"github.com/python-pillow/Pillow/pull/10010","hostname":"github.com","tags":["X Refsource MISC"]},{"url":"https://github.com/python-pillow/Pillow/commit/80de4be9e38d3a6148dd4d8491eb80cd12b760a4","label":"github.com/python-pillow/Pillow/commit/80de4be9e38d3a6148dd4d8491eb80cd12b760a4","hostname":"github.com","tags":["X Refsource MISC"]},{"url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0","label":"github.com/python-pillow/Pillow/releases/tag/13.0.0","hostname":"github.com","tags":["X Refsource MISC"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-96641","label":"security-tracker.debian.org/tracker/CVE-2026-96641","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-21T20:51:24.388Z","label":"Published","detail":"Vulnerability first disclosed.","source":null}],"risk":{"score":26,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T12:42:36.678Z","stale":false,"partial":false}}