CVE-2026-112397

Received Received - Intake

Memory Corruption in Pillow Image Processing Library

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[width - 1] without rejecting that geometry. An attacker can supply such an image to an application that applies a morphology operation. This can crash the process. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112397

Affected Vendors & Products

Vendor	Product	Version / Range
python-pillow	Pillow	< 13.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Pillow, a Python imaging library, before version 13.0.0. It involves the ImageMorph.MorphOp.apply() function accessing memory before a row buffer when processing zero-width images. Attackers can exploit this by providing specially crafted PPM or PGM images with zero width to applications using morphology operations, causing crashes.

Detection Guidance

Check if your system uses Pillow version before 13.0.0 by running: pip show Pillow. If the version is below 13.0.0, the system is vulnerable. Monitor for crashes when processing PPM or PGM images with morphology operations.

Impact Analysis

This vulnerability can cause denial-of-service by crashing applications that process malicious images. If your software uses Pillow for image processing and applies morphology operations, an attacker could trigger crashes by supplying zero-width images, disrupting service.

Mitigation Strategies

Upgrade Pillow to version 13.0.0 or later using: pip install --upgrade Pillow. Avoid processing PPM or PGM images with morphology operations until updated. Review applications using Pillow for potential exposure.

Hi! I’m here to help you understand CVE-2026-112397. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70