{"metadata": {"vulnerability": "CVE-2026-96638", "count": 19, "kinds": {"milestone": 6, "sighting": 2, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-09-23T14:35:50.130Z", "date_only": false, "value": "2026-09-23T14:35:50.130Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-96638", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-21T20:47:21.767Z", "date_only": false, "value": "2026-10-21T20:47:21.767Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-96638", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-21T20:47:21.767Z", "date_only": false, "value": "2026-10-21T20:47:21.767Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-96638", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-21T20:47:21.767Z", "date_only": false, "value": "2026-10-21T20:47:21.767Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-96638", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-21T20:57:38.892Z", "date_only": false, "value": "2026-10-21T20:57:38.892386Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117480899052523630", "record": "CVE-2026-96638", "field": "creation_timestamp", "uuid": "427eab9f-7ba1-4cba-aec9-eccd15f417cb", "content": "CVE-2026-96638 Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining dest_length without a per-branch cap. A delta can add roughly 255 image rows in one iteration, so a kilobyte-sized file with a large but permitted width can expand the data bytearray to hundreds of megabytes or more, causing memory-exhaustion denial of service. This issue is fixed in version 13.0.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-96638https://github.com/python-pillow/Pillow/security/advisories/GHSA-24rc-8hj2-v98chttps://github.com/python-pillow/Pillow/pull/10015https://github.com/python-pillow/Pillow/commit/e7794835e323ff2691d9b3a974cade1a44301b9ahttps://github.com/python-pillow/Pillow/releases/tag/13.0.0#python-pillow #Pillow#CVE_2026_96638#bot", "url": "https://infosec.exchange/users/cve/statuses/117480899052523630"}, {"timestamp": "2026-10-21T21:20:32Z", "date_only": false, "value": "2026-10-21T21:20:32Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-24RC-8HJ2-V98C", "record": "GHSA-24RC-8HJ2-V98C", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-21T21:20:32.067Z", "date_only": false, "value": "2026-10-21T21:20:32.067", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96638", "record": "FKIE_CVE-2026-96638", "field": "published"}, {"timestamp": "2026-10-22T15:59:35Z", "date_only": false, "value": "2026-10-22T15:59:35Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-24RC-8HJ2-V98C", "record": "GHSA-24RC-8HJ2-V98C", "field": "published"}, {"timestamp": "2026-10-22T15:59:35Z", "date_only": false, "value": "2026-10-22T15:59:35.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/advisories/GHSA-24rc-8hj2-v98c", "record": "CVE-2026-96638", "field": "creation_timestamp", "uuid": "8e9d0c89-25b6-4389-82b6-0dc9f52229d0", "url": "https://github.com/advisories/GHSA-24rc-8hj2-v98c"}, {"timestamp": "2026-10-22T15:59:35Z", "date_only": false, "value": "2026-10-22T15:59:35Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-24RC-8HJ2-V98C", "record": "GHSA-24RC-8HJ2-V98C", "field": "modified"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12251-1", "record": "OPENSUSE-SU-2026:12251-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12251-1", "record": "OPENSUSE-SU-2026:12251-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12251-1", "record": "OPENSUSE-SU-2026:12251-1", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12251-1", "record": "OPENSUSE-SU-2026:12251-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": false, "value": "2026-10-23T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-96638", "record": "UBUNTU-CVE-2026-96638", "field": "published"}, {"timestamp": "2026-10-24T08:49:49Z", "date_only": false, "value": "2026-10-24T08:49:49Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12251-1", "record": "OPENSUSE-SU-2026:12251-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-24T08:49:49Z", "date_only": false, "value": "2026-10-24T08:49:49Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12251-1", "record": "OPENSUSE-SU-2026:12251-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-27T01:56:18Z", "date_only": false, "value": "2026-10-27T01:56:18Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-96638", "record": "UBUNTU-CVE-2026-96638", "field": "modified"}, {"timestamp": "2026-10-27T14:25:07.010Z", "date_only": false, "value": "2026-10-27T14:25:07.010", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96638", "record": "FKIE_CVE-2026-96638", "field": "lastModified"}]}