CVE-2026-112402

Received Received - Intake

Double Free in Pillow Image Transform

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description

Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST resampling. The output image allocation must succeed while the additional per-column lookup allocation fails, after which the error path deletes image storage that later cleanup releases again. An attacker who can drive such a large Image.transform() operation under memory pressure may trigger the failure. This can crash the process and may corrupt memory. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112402

Affected Vendors & Products

Vendor	Product	Version / Range
python-pillow	Pillow	< 13.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability in Pillow, a Python imaging library, involves a double free of image memory. It occurs when the ImagingScaleAffine function fails to allocate memory for a per-column lookup during image transformation operations like Transform.EXTENT or pure scale-and-translate Transform.AFFINE with NEAREST resampling. The output image allocation succeeds, but the lookup allocation fails, leading to an error path that deletes the image storage. Later cleanup attempts to release the same memory again, causing a crash or memory corruption. The issue is fixed in Pillow version 13.0.0.

Detection Guidance

Detection involves checking for vulnerable Pillow versions and monitoring for crashes during Image.transform() operations. Use pip show Pillow to check the installed version. If it is below 13.0.0, the system is vulnerable. Monitor application logs for segmentation faults or memory corruption errors during image processing tasks.

Impact Analysis

An attacker could exploit this vulnerability by triggering a large Image.transform() operation under memory pressure. This may crash the application using Pillow, corrupt memory, or potentially lead to arbitrary code execution. Users of affected versions should update to Pillow 13.0.0 or later to mitigate the risk.

Mitigation Strategies

Upgrade Pillow to version 13.0.0 or later immediately using pip install --upgrade Pillow. If upgrading is not possible, avoid using Image.transform() with Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with NEAREST resampling under memory pressure.

Hi! I’m here to help you understand CVE-2026-112402. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70