CVE-2026-112397High· 8.7▾ MidnightPoC availablePillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routi…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.8 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[width - 1] without rejecting that geometry. An attacker can supply such an image to an application that applies a morphology operation. This can crash the process. This issue is fixed in version 13.0.0.
Pillow < 13.0.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112398Critical· 9.2Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
CVE-2026-112393Critical· 9.2Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
CVE-2026-112402High· 8.7Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
CVE-2026-112390High· 8.2Pillow: Infinite loop in MIC n_frames when the embedded TIFF
CVE-2026-112394Medium· 6.3Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
CVE-2026-112391Medium· 6.3Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()