SUSE-SU-2026:5038-1: python-Pillow&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7 SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:5038-1 is a vulnerability in python-Pillow&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7 SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 02-11-2026
   PublishedVulnerability first disclosed.
2. 03-11-2026
   Last modifiedVulnerability information updated.

Description

Security update for python-Pillow This update for python-Pillow fixes the following issues: - CVE-2026-96636: decompression-bomb protection bypass via multi-frame `seek()` in MPO and DCX (bsc#1286802). - CVE-2026-96637: decompression bomb check bypass in `SpiderImagePlugin.seek()` leads to unbounded allocation DoS (bsc#1286801). - CVE-2026-96640: PDF append accepts malformed shared page-tree DAG, which can cause resource exhaustion (bsc#1286798). - CVE-2026-96641: reachable undefined behavior in native integer operations can lead to denial of service or logic integrity compromise (bsc#1286797). - CVE-2026-96642: `TarIO` negative size field causes infinite CPU-spin loop (bsc#1286796). - CVE-2026-112390: Denial of Service via infinite loop during crafted MIC image parsing (bsc#1286256). - CVE-2026-112391: Denial of Service via unbounded recursion in PDF parser (bsc#1286273). - CVE-2026-112392: Denial of Service via zero-size images in rank filters (bsc#1286287). - CVE-2026-112393: heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data (bsc#1286325). - CVE-2026-112394: `P;2L` and `P;4L` decoders may read 1 to 3 bytes past the passed buffer size (bsc#1286311). - CVE-2026-112397: out-of-bounds access in `_imagingmorph` on a zero-width image (bsc#1286314). - CVE-2026-112398: heap buffer overflow in FPX JPEG decoding can lead to code execution (bsc#1286406). - CVE-2026-112399: Denial of service via crafted APNG image (bsc#1286368). - CVE-2026-112400: Denial of Service via memory exhaustion from crafted GIF image (bsc#1286370). - CVE-2026-112401: Denial of Service via crafted GIF comments (bsc#1286372). - CVE-2026-112402: Denial of service via double free during image transformation (bsc#1286381). - CVE-2026-112403: heap buffer overflow in `ImagingJpegDecode` allows for code execution (bsc#1286405). - CVE-2026-112405: NULL pointer dereference in `Image.merge` via an unvalidated band 0 (bsc#1286404). - CVE-2026-112406: infinite loop in `PdfParser.rewrite_pages` on page tree `Parent` cycle (bsc#1286403). - CVE-2026-112891: quadratic GIF comment copying during save (bsc#1286402). - CVE-2026-112892: MSP RLE decoder expands a tiny file into unbounded memory (bsc#1286401). - CVE-2026-112894: Denial of Service via crafted multi-frame image conversion (bsc#1286408). - CVE-2026-112895: Denial of service via crafted PDF during append operations (bsc#1286411). - CVE-2026-112896: TIFF encoder `ColorMap` plane-size mismatch causes a heap out-of-bounds read (bsc#1286400). - CVE-2026-112897: `TiffDecode` returns uninitialized memory as pixels for short JPEG strips (bsc#1286398). - CVE-2026-112899: EPS `load(scale)` lets Ghostscript render past the decompression bomb limit (bsc#1286489). - CVE-2026-112900: argument Injection in Ghostscript call can lead to remote code execution (bsc#1286397). - CVE-2026-112901: ReDoS in `XbmImagePlugin` can be triggered by 512-byte file (bsc#1286396). - CVE-2026-112902: memory disclosure and segfault in libtiff encoder via crafted TIFF tags (bsc#1286804).

No weakness data has been published for this record.