{"id":"SUSE-SU-2026:5038-1","summary":"Security update for python-Pillow","details":"This update for python-Pillow fixes the following issues:\n\n- CVE-2026-96636: decompression-bomb protection bypass via multi-frame `seek()` in MPO and DCX (bsc#1286802).\n- CVE-2026-96637: decompression bomb check bypass in `SpiderImagePlugin.seek()` leads to unbounded allocation DoS\n  (bsc#1286801).\n- CVE-2026-96640: PDF append accepts malformed shared page-tree DAG, which can cause resource exhaustion (bsc#1286798).\n- CVE-2026-96641: reachable undefined behavior in native integer operations can lead to denial of service or logic\n  integrity compromise (bsc#1286797).\n- CVE-2026-96642: `TarIO` negative size field causes infinite CPU-spin loop (bsc#1286796).\n- CVE-2026-112390: Denial of Service via infinite loop during crafted MIC image parsing (bsc#1286256).\n- CVE-2026-112391: Denial of Service via unbounded recursion in PDF parser (bsc#1286273).\n- CVE-2026-112392: Denial of Service via zero-size images in rank filters (bsc#1286287).\n- CVE-2026-112393: heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data\n  (bsc#1286325).\n- CVE-2026-112394: `P;2L` and `P;4L` decoders may read 1 to 3 bytes past the passed buffer size (bsc#1286311).\n- CVE-2026-112397: out-of-bounds access in `_imagingmorph` on a zero-width image (bsc#1286314).\n- CVE-2026-112398: heap buffer overflow in FPX JPEG decoding can lead to code execution (bsc#1286406).\n- CVE-2026-112399: Denial of service via crafted APNG image (bsc#1286368).\n- CVE-2026-112400: Denial of Service via memory exhaustion from crafted GIF image (bsc#1286370).\n- CVE-2026-112401: Denial of Service via crafted GIF comments (bsc#1286372).\n- CVE-2026-112402: Denial of service via double free during image transformation (bsc#1286381).\n- CVE-2026-112403: heap buffer overflow in `ImagingJpegDecode` allows for code execution (bsc#1286405).\n- CVE-2026-112405: NULL pointer dereference in `Image.merge` via an unvalidated band 0 (bsc#1286404).\n- CVE-2026-112406: infinite loop in `PdfParser.rewrite_pages` on page tree `Parent` cycle (bsc#1286403).\n- CVE-2026-112891: quadratic GIF comment copying during save (bsc#1286402).\n- CVE-2026-112892: MSP RLE decoder expands a tiny file into unbounded memory (bsc#1286401).\n- CVE-2026-112894: Denial of Service via crafted multi-frame image conversion (bsc#1286408).\n- CVE-2026-112895: Denial of service via crafted PDF during append operations (bsc#1286411).\n- CVE-2026-112896: TIFF encoder `ColorMap` plane-size mismatch causes a heap out-of-bounds read (bsc#1286400).\n- CVE-2026-112897: `TiffDecode` returns uninitialized memory as pixels for short JPEG strips (bsc#1286398).\n- CVE-2026-112899: EPS `load(scale)` lets Ghostscript render past the decompression bomb limit (bsc#1286489).\n- CVE-2026-112900: argument Injection in Ghostscript call can lead to remote code execution (bsc#1286397).\n- CVE-2026-112901: ReDoS in `XbmImagePlugin` can be triggered by 512-byte file (bsc#1286396).\n- CVE-2026-112902: memory disclosure and segfault in libtiff encoder via crafted TIFF tags (bsc#1286804).\n","modified":"2026-11-03T13:15:08.326276184Z","published":"2026-11-02T16:22:03Z","related":["CVE-2026-112390","CVE-2026-112391","CVE-2026-112392","CVE-2026-112393","CVE-2026-112394","CVE-2026-112397","CVE-2026-112398","CVE-2026-112399","CVE-2026-112400","CVE-2026-112401","CVE-2026-112402","CVE-2026-112403","CVE-2026-112405","CVE-2026-112406","CVE-2026-112891","CVE-2026-112892","CVE-2026-112894","CVE-2026-112895","CVE-2026-112896","CVE-2026-112897","CVE-2026-112899","CVE-2026-112900","CVE-2026-112901","CVE-2026-112902","CVE-2026-96636","CVE-2026-96637","CVE-2026-96640","CVE-2026-96641","CVE-2026-96642"],"upstream":["CVE-2026-112390","CVE-2026-112391","CVE-2026-112392","CVE-2026-112393","CVE-2026-112394","CVE-2026-112397","CVE-2026-112398","CVE-2026-112399","CVE-2026-112400","CVE-2026-112401","CVE-2026-112402","CVE-2026-112403","CVE-2026-112405","CVE-2026-112406","CVE-2026-112891","CVE-2026-112892","CVE-2026-112894","CVE-2026-112895","CVE-2026-112896","CVE-2026-112897","CVE-2026-112899","CVE-2026-112900","CVE-2026-112901","CVE-2026-112902","CVE-2026-96636","CVE-2026-96637","CVE-2026-96640","CVE-2026-96641","CVE-2026-96642"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265038-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286256"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286273"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286287"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286311"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286314"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286325"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286368"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286370"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286372"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286381"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286396"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286397"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286398"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286400"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286401"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286402"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286403"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286404"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286405"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286406"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286408"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286411"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286489"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286796"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286797"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286798"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286801"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286802"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286804"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112390"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112391"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112392"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112393"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112394"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112397"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112398"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112399"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112400"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112401"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112402"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112403"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112405"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112406"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112891"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112892"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112894"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112895"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112896"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112897"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112899"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112900"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112901"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-112902"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-96636"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-96637"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-96640"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-96641"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-96642"}],"affected":[{"package":{"name":"python-Pillow","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","purl":"pkg:rpm/suse/python-Pillow&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.0-150300.3.33.1"}]}],"ecosystem_specific":{"binaries":[{"python3-Pillow":"7.2.0-150300.3.33.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5038-1.json"}}],"schema_version":"1.9.2"}