CVE-2026-112402
published 2026-10-19CVE-2026-112402: Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The…
PriorityP350high8.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.51%
43.4th percentile
Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST resampling. The output image allocation must succeed while the additional per-column lookup allocation fails, after which the error path deletes image storage that later cleanup releases again. An attacker who can drive such a large Image.transform() operation under memory pressure may trigger the failure. This can crash the process and may corrupt memory. This issue is fixed in version 13.0.0.
Affected
85 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform | automation-dashboard-rhel9 | — | — |
| exploit-intelligence | vulnerability-analysis-rhel9 | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| lightspeed-core | rag-tool-cpu-rhel9 | — | — |
| lightspeed-core | rag-tool-cuda-12.9-rhel9 | — | — |
| lightspeed-services-ocp | ocp-rules-rhel9 | — | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| python-pillow | pillow | < 13.0.0 | 13.0.0 |
| python | pillow | >= 0 < 13.0.0 | 13.0.0 |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| rhai-early-access | docling-sdk-cuda-rhel9 | — | — |
| rhai-early-access | docling-serve-cuda-rhel9 | — | — |
| rhai | guidellm-rhel9 | — | — |
| rhaii | model-opt-cuda-rhel9 | — | — |
| rhaii | vllm-cpu-rhel9 | — | — |
| rhaii | vllm-cuda-rhel9 | — | — |
| rhaii | vllm-gaudi-rhel9 | — | — |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
ghsa·2026-10-21
CVE-2026-112402 [HIGH] CWE-416 Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
```
Double free in ImagingScaleAffine on calloc failure via Image.transform
Location: src/libImaging/Geometry.c:866 in ImagingScaleAffine()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
```
There is a double free in Pillow's `Image.transform()` that crashes the process when an oversized transform runs out of memory. Instead of only raising `MemoryError`, Pillow frees the output image's memory once while handling the error and then again when the Python object is cleaned up. Anyone who can choose the output size of `Image.transform()` can trigger it, but only on a worker with a memory limit (a common hardening for image workers) or a 32-bit process. The result is a crash of the worker, plus corruption of it
VulDB
python-pillow Pillow up to 12.x Transform ImagingScaleAffine double free
vuldb·2026-10-20·CVSS 8.7
CVE-2026-112402 [HIGH] python-pillow Pillow up to 12.x Transform ImagingScaleAffine double free
A vulnerability, which was classified as critical, has been found in python-pillow Pillow up to 12.x. This impacts the function ImagingScaleAffine of the component Transform. This manipulation causes double free.
This vulnerability appears as CVE-2026-112402. The attack may be initiated remotely. There is no available exploit.
It is advisable to upgrade the affected component.
Red Hat
pillow: pillow: Denial of service via double free during image transformation
vendor_redhat·2026-10-19·CVSS 8.7
CVE-2026-112402 [HIGH] CWE-1341 pillow: pillow: Denial of service via double free during image transformation
pillow: pillow: Denial of service via double free during image transformation
A flaw was found in Pillow. A remote attacker who can submit large image transformation operations under memory pressure can trigger improper error handling, leading to a double-free vulnerability (releasing the same memory block twice). This issue can result in an application crash, causing a Denial of Service (DoS), and may potentially lead to memory corruption.
Package: exploit-intelligence/vulnerability-analysis-rhel9 (Exploit Intelligence) - Affected
Package: lightspeed-core/lightspeed-stack-rhel9 (Lightspeed Core) - Affected
Package: lightspeed-core/rag-tool-cpu-rhel9 (Lightspeed Core) - Affected
Package: lightspeed-core/rag-tool-cuda-12.9-rhel9 (Lightspeed Core) - Affected
Package: openshift-lightspe
No detection rules found.
No public exploits indexed.
https://github.com/python-pillow/Pillow/commit/aafa6c75f7cdabb9f409a8aac7c780bea31d08d9https://github.com/python-pillow/Pillow/releases/tag/13.0.0https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrmhttps://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm
2026-10-19
Published