CVE-2026-112893

Received Received - Intake

Memory Corruption in Pillow via FreeType Stroker

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description

Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112893

Affected Vendors & Products

Vendor	Product	Version / Range
python-pillow	Pillow	>= 10.0.0, < 13.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-457	The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
CWE-763	The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.

Attack-Flow Graph

Executive Summary

Pillow is a Python imaging library. The vulnerability exists in versions 10.0.0 to 13.0.0 where an invalid glyph pointer can be freed during FreeType rendering if a stroker is active. When FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. Attackers can exploit this by providing a malformed font to applications drawing text with a nonzero stroke width, causing memory corruption or crashes.

Detection Guidance

This vulnerability is specific to applications using Pillow versions 10.0.0 to 13.0.0 with FreeType rendering and nonzero stroke width. Check Pillow version with pip show Pillow. Inspect applications using Pillow for text rendering with stroke width settings.

Impact Analysis

This vulnerability can lead to memory corruption or crashes in applications using Pillow for text rendering with stroke width. Attackers could exploit it by supplying malicious fonts, potentially causing denial of service or unexpected behavior in affected software.

Mitigation Strategies

Upgrade Pillow to version 13.0.0 or later immediately. If upgrading is not possible, disable text rendering with nonzero stroke width in affected applications until the update is applied.

Hi! I’m here to help you understand CVE-2026-112893. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70