{"id":"CVE-2026-96643","revision":null,"records":[{"revision":"8b6d6635475142b2b259eab08d71abed","observedAt":"2026-10-23T22:48:20.692+00:00","statement":{"source":"cve-program","id":"CVE-2026-96643","aliases":[],"title":"Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time","description":"Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new shrinking copy on every iteration and quadratic CPU work. The condition is reachable through Image.getexif(), Image._getexif(), and ImageOps.exif_transpose(), including common photo-upload rotation workflows. This issue is fixed in version 13.0.0.","state":0,"publishedAt":"2026-10-21T20:56:26.344+00:00","modifiedAt":"2026-10-23T21:19:12.901+00:00","affected":[{"ecosystem":"Vendor product","name":"Pillow","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"python-pillow\",\n                    \"product\": \"Pillow\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 11.0.0, < 13.0.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":7.1,"severity":"HIGH"}],"references":["https://github.com/python-pillow/Pillow/security/advisories/GHSA-g4qv-2jxx-769h","https://github.com/python-pillow/Pillow/pull/10073","https://github.com/python-pillow/Pillow/commit/806e38381c781f32bbd22f4cd026678acd40fd6c","https://github.com/python-pillow/Pillow/releases/tag/13.0.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-96643","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-96643","identifiers":["CVE-2026-96643"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-26T14:35:48.1677058+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-26T14:35:48.1677058+00:00","lastSuccessAt":"2026-10-26T14:35:48.3516958+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:48.3516975+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-5ba1945314e042c2ced14b33f3680fa71692812d925544312b218f5eb8a26e71-c9e0dc0e630c65d3e2eec6bfd23be086a2f833dd3e7570a16b44670030aaf25b","complete":true,"records":414172,"lastAttemptAt":"2026-10-26T14:35:43.3458888+00:00","lastSuccessAt":"2026-10-26T14:35:43.2997194+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:43.3458888+00:00","snapshotPublishedAt":"2026-10-26T13:53:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-26T14:36:16.7068084+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":4064,"expectedIdentifiers":13477},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-26T14:35:48.1677058+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-26T14:35:48.1677058+00:00","lastSuccessAt":"2026-10-26T14:35:48.3524508+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:48.3524813+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ddf1516e1d944b74b0e29872646a7464","complete":true,"records":13416,"lastAttemptAt":"2026-10-26T14:36:14.7824466+00:00","lastSuccessAt":"2026-10-26T14:36:14.779+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:36:14.779+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13477,"expectedIdentifiers":13477},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-26T14:35:43.7672517+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:43.7672517+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-26T14:35:43.5489133+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:43.5489133+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-a393d8fe0ae8408f3e4cab413b76047090c8e4a3c0a186c79edf33c9a3d3af95","complete":true,"records":2995,"lastAttemptAt":"2026-10-26T14:35:48.1177056+00:00","lastSuccessAt":"2026-10-26T14:35:47.9640893+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:48.1177056+00:00","snapshotPublishedAt":"2026-10-26T14:18:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-690135177074a0c4b9ddcb48232cb870c32b1a7adcd972a81c224810b8437d0d","complete":true,"records":230805,"lastAttemptAt":"2026-10-26T14:35:43.6565309+00:00","lastSuccessAt":"2026-10-26T12:37:54.7648812+00:00","error":null,"lastVerifiedAt":"2026-10-26T14:35:43.6565309+00:00","snapshotPublishedAt":"2026-10-26T11:48:32+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}