CVE-2026-112405

Received Received - Intake

Null Pointer Dereference in Pillow Image.merge()

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description

Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC file can reach this path when an application opens and loads it, or a caller can invoke Image.merge() directly with such a first band. This causes a native process crash. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112405

Affected Vendors & Products

Vendor	Product	Version / Range
python-pillow	Pillow	>= 12.0.0, < 13.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability in Pillow (Python imaging library) occurs in the Image.merge() function between versions 12.0.0 and 13.0.0. It allows dereferencing a null image8 plane due to skipped validation of the first input band. This can cause a native process crash when processing crafted IPTC files or when Image.merge() is called directly with specific parameters.

Detection Guidance

This vulnerability can be detected by checking the installed version of Pillow. Run 'pip show Pillow' to verify if the version is between 12.0.0 and 12.9.9. If so, the system is vulnerable.

Impact Analysis

The vulnerability can cause applications using affected Pillow versions to crash unexpectedly when processing certain image files. This may lead to denial of service, data loss, or application instability. Attackers could exploit this by providing maliciously crafted IPTC files to trigger the crash.

Mitigation Strategies

Upgrade Pillow to version 13.0.0 or later using 'pip install --upgrade Pillow'. If upgrading is not possible, avoid processing untrusted IPTC files or using Image.merge() with crafted inputs.

Hi! I’m here to help you understand CVE-2026-112405. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70