DailyCVE@dailycve
🔴 #Python Pillow, NULL Dereference, #CVE-2026-112392 (High) -DC-Oct2026-3568 https://dailycve.com/python-pillow-null-dereference-cve-2026-112392-high-dc-oct2026-3568/
0000018
244 followersView on X
CVE-2026-112392
LOWCVSS 8.2 · HIGHImmediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter is never reached. An attacker can supply or cause creation of a zero-size image to an application that applies a rank, median, minimum, or maximum filter. This causes a native process crash. This issue is fixed in version 13.0.0.
0.0/ 10 priority
Sources & remediation
Other references
- https://github.com/python-pillow/Pillow/commit/443e3130a8c11594fd0e296afad497e11e678961
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-27h8-gf7j-v5hc
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-27h8-gf7j-v5hc
Weakness type (CWE)
CWE-476
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE