CVE-2026-112392
published 2026-10-19CVE-2026-112392: Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand()…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.50%
42.6th percentile
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter is never reached. An attacker can supply or cause creation of a zero-size image to an application that applies a rank, median, minimum, or maximum filter. This causes a native process crash. This issue is fixed in version 13.0.0.
Affected
86 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform | automation-dashboard-rhel9 | — | — |
| exploit-intelligence | vulnerability-analysis-rhel9 | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| lightspeed-core | rag-tool-cpu-rhel9 | — | — |
| lightspeed-core | rag-tool-cuda-12.9-rhel9 | — | — |
| lightspeed-services-ocp | ocp-rules-rhel9 | — | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| python-pillow | pillow | < 13.0.0 | 13.0.0 |
| python | pillow | < 13.0.0 | 13.0.0 |
| python | pillow | >= 0 < 13.0.0 | 13.0.0 |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| rhai-early-access | docling-sdk-cuda-rhel9 | — | — |
| rhai-early-access | docling-serve-cuda-rhel9 | — | — |
| rhai | guidellm-rhel9 | — | — |
| rhaii | model-opt-cuda-rhel9 | — | — |
| rhaii | vllm-cpu-rhel9 | — | — |
| rhaii | vllm-cuda-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
ghsa·2026-10-21
CVE-2026-112392 [HIGH] CWE-476 Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
```
NULL dereference in ImagingExpand via rank filters on zero-size images
Location: src/libImaging/Filter.c:79 in ImagingExpand()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
```
Applying Pillow's median, minimum, maximum or rank filter to an image with zero width or zero height crashes the whole Python process instead of raising an error. Empty images like this are easy to produce with ordinary calls, for example a crop box whose left and right edges (or top and bottom edges) are equal, or the second page of a crafted multi-page image file. An attacker who can supply crop coordinates or an uploaded file to an application that runs one of these filters can kill its worker process. The effect is a crash on
VulDB
python-pillow Pillow up to 12.x Rank-based filters ImagingExpand null pointer dereference
vuldb·2026-10-20·CVSS 8.2
CVE-2026-112392 [HIGH] python-pillow Pillow up to 12.x Rank-based filters ImagingExpand null pointer dereference
A vulnerability was found in python-pillow Pillow up to 12.x. It has been classified as problematic. This affects the function ImagingExpand of the component Rank-based filters. The manipulation leads to null pointer dereference.
This vulnerability is uniquely identified as CVE-2026-112392. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is recommended.
Red Hat
pillow: pillow: Denial of Service via zero-size images in rank filters
vendor_redhat·2026-10-19·CVSS 8.2
CVE-2026-112392 [HIGH] CWE-125 pillow: pillow: Denial of Service via zero-size images in rank filters
pillow: pillow: Denial of Service via zero-size images in rank filters
A flaw was found in Pillow. An attacker can cause a Denial of Service (DoS) by submitting a zero-size image to an application that applies rank-based filters, such as median, minimum, or maximum filters. When attempting to expand the image borders, Pillow reads from unallocated image storage, resulting in an application crash.
Package: exploit-intelligence/vulnerability-analysis-rhel9 (Exploit Intelligence) - Affected
Package: lightspeed-core/lightspeed-stack-rhel9 (Lightspeed Core) - Affected
Package: lightspeed-core/rag-tool-cpu-rhel9 (Lightspeed Core) - Affected
Package: lightspeed-core/rag-tool-cuda-12.9-rhel9 (Lightspeed Core) - Affected
Package: openshift-lightspeed/lightspeed-ocp-rag-rhel9 (OpenShift Lights
No detection rules found.
No public exploits indexed.
https://github.com/python-pillow/Pillow/commit/443e3130a8c11594fd0e296afad497e11e678961https://github.com/python-pillow/Pillow/releases/tag/13.0.0https://github.com/python-pillow/Pillow/security/advisories/GHSA-27h8-gf7j-v5hchttps://github.com/python-pillow/Pillow/security/advisories/GHSA-27h8-gf7j-v5hc
2026-10-19
Published