CVE-2026-112402High· 8.7▾ MidnightPoC availablePillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Trans…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.8 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST resampling. The output image allocation must succeed while the additional per-column lookup allocation fails, after which the error path deletes image storage that later cleanup releases again. An attacker who can drive such a large Image.transform() operation under memory pressure may trigger the failure. This can crash the process and may corrupt memory. This issue is fixed in version 13.0.0.
Pillow < 13.0.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112396Medium· 5.9Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
CVE-2026-112393Critical· 9.2Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
CVE-2026-112397High· 8.7Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
CVE-2026-112390High· 8.2Pillow: Infinite loop in MIC n_frames when the embedded TIFF
CVE-2026-112394Medium· 6.3Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
CVE-2026-112391Medium· 6.3Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()