CVE-2026-112397
published 2026-10-19CVE-2026-112397: Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and…
PriorityP352high8.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.49%
42.1th percentile
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[width - 1] without rejecting that geometry. An attacker can supply such an image to an application that applies a morphology operation. This can crash the process. This issue is fixed in version 13.0.0.
Affected
85 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform | automation-dashboard-rhel9 | — | — |
| exploit-intelligence | vulnerability-analysis-rhel9 | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| lightspeed-core | rag-tool-cpu-rhel9 | — | — |
| lightspeed-core | rag-tool-cuda-12.9-rhel9 | — | — |
| lightspeed-services-ocp | ocp-rules-rhel9 | — | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| python-pillow | pillow | < 13.0.0 | 13.0.0 |
| python | pillow | >= 0 < 13.0.0 | 13.0.0 |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| rhai-early-access | docling-sdk-cuda-rhel9 | — | — |
| rhai-early-access | docling-serve-cuda-rhel9 | — | — |
| rhai | guidellm-rhel9 | — | — |
| rhaii | model-opt-cuda-rhel9 | — | — |
| rhaii | vllm-cpu-rhel9 | — | — |
| rhaii | vllm-cuda-rhel9 | — | — |
| rhaii | vllm-gaudi-rhel9 | — | — |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images
vendor_redhat·2026-10-19·CVSS 8.7
CVE-2026-112397 [HIGH] CWE-124 pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images
pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images
A flaw was found in Pillow. A remote attacker can cause a Denial of Service (DoS) by supplying a specially crafted image with a width of zero to an application performing morphology operations. Because Pillow fails to validate zero-width image geometry during these operations, it attempts an out-of-bounds memory access before the buffer boundary, resulting in an application crash.
Package: exploit-intelligence/vulnerability-analysis-rhel9 (Exploit Intelligence) - Affected
Package: lightspeed-core/lightspeed-stack-rhel9 (Lightspeed Core) - Affected
Package: lightspeed-core/rag-tool-cpu-rhel9 (Lightspeed Core) - Affected
Package: lightspeed-core/rag-tool-cuda-12.9-rhel9 (Lightspeed Core) - Affected
P
GHSA
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
ghsa·2026-10-20
CVE-2026-112397 [HIGH] CWE-787 Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
### Summary
A PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size `(0, N)`. Passing that image to `ImageMorph.MorphOp.apply()` makes the native morphology code index a row buffer at `outrow[width - 1]`, which is `outrow[-1]` when the width is 0. The process crashes.
### Details
The PPM parser reads width and height with no lower-bound check:
- `src/PIL/PpmImagePlugin.py:119`
The native `apply()` writes the row edges with no guard that the width is positive:
- `src/_imagingmorph.c:81` sets `outrow[0] = outrow[width - 1] = 0;`
`match()` and `get_on_pixels()` use the same edge-indexing pattern.
### PoC
```python
from PIL import Image, ImageMorph
# A width-0 image (also producible
VulDB
python-pillow Pillow up to 12.x Morphology ImageMorph.MorphOp.apply buffer overflow
vuldb·2026-10-20·CVSS 8.7
CVE-2026-112397 [HIGH] python-pillow Pillow up to 12.x Morphology ImageMorph.MorphOp.apply buffer overflow
A vulnerability described as problematic has been identified in python-pillow Pillow up to 12.x. The affected element is the function ImageMorph.MorphOp.apply of the component Morphology. Executing a manipulation can lead to buffer overflow.
This vulnerability is registered as CVE-2026-112397. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is recommended.
No detection rules found.
No public exploits indexed.
https://github.com/python-pillow/Pillow/commit/18f7c0dfee93063c51db6ed0ca8c4da2999dcb64https://github.com/python-pillow/Pillow/releases/tag/13.0.0https://github.com/python-pillow/Pillow/security/advisories/GHSA-58r4-6rv3-gfh8https://github.com/python-pillow/Pillow/security/advisories/GHSA-58r4-6rv3-gfh8
2026-10-19
Published