CVE-2026-112394

Received Received - Intake

Heap Buffer Overflow in Pillow Image Library

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can read past the end of an input buffer. ImagingRawDecode calculates a packed-pixel row size, while the unpackers read separately padded bit planes. A caller can supply a buffer and image dimensions whose accepted size is smaller than the unpacker's actual footprint. This can disclose up to three adjacent heap bytes in output pixels or crash the process. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112394

Affected Vendors & Products

Vendor	Product	Version / Range
python-pillow	Pillow	< 13.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-126	The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Attack-Flow Graph

Executive Summary

Pillow is a Python imaging library. Prior to version 13.0.0, its P;2L and P;4L raw decoders can read past the end of an input buffer. This happens because ImagingRawDecode calculates a packed-pixel row size while unpackers read separately padded bit planes. A malicious caller can provide a buffer and image dimensions that make the accepted size smaller than the unpacker's actual memory requirement. This may disclose up to three adjacent heap bytes in output pixels or crash the process.

Detection Guidance

This vulnerability can be detected by checking the version of Pillow installed on your system. Run 'pip show Pillow' or 'python -c "import PIL; print(PIL.__version__)"' to verify if the version is below 13.0.0.

Impact Analysis

This vulnerability could allow an attacker to read sensitive memory data or cause a denial-of-service by crashing the application. If exploited, it may expose up to three adjacent heap bytes in the output pixels, potentially leaking confidential information. Systems using Pillow versions before 13.0.0 are at risk.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's confidentiality requirements. If exploited, it may result in data breaches, triggering compliance violations, legal penalties, and reputational damage for organizations handling sensitive data.

Mitigation Strategies

Upgrade Pillow to version 13.0.0 or later immediately using 'pip install --upgrade Pillow'. If upgrading is not possible, consider disabling the P;2L and P;4L raw decoders if they are not required.

Hi! I’m here to help you understand CVE-2026-112394. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70