VulnSocial

CVE-2026-112403

LOWCVSS 9.2 · CRITICAL

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can ignore the requested downscaling geometry. An attacker can supply such a JPEG to an application that uses draft() or thumbnail() to request downscaling. This can corrupt heap memory, crash the process, or potentially allow code execution. Older libjpeg-turbo 2.x and IJG builds reject the SOF3 input. This issue is fixed in version 13.0.0.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-122

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse9 posts
  • MCP Scores@MCPScores

    🚨 Critical vulnerability io.github.docling-project/docling-mcp Unpatched critical vulnerability (CVE-2026-112403). A fixed version is available. Trust score: 39 → 0

    1001019
    5 followersView on X
  • MCP Scores@MCPScores

    🚨 Critical vulnerability io.github.KittyCAD/zoo-mcp Unpatched critical vulnerability (CVE-2026-112403). A fixed version is available. Trust score: 64 → 0

    100007
    5 followersView on X
  • MCP Scores@MCPScores

    🚨 Critical vulnerability io.github.vitaliemiron/cookidoo-mcp Unpatched critical vulnerability (CVE-2026-112403). A fixed version is available. Trust score: 93 → 0

    1000011
    5 followersView on X
  • MCP Scores@MCPScores

    🚨 Critical vulnerability io.github.chaoscypherinc/chaoscypher Unpatched critical vulnerability (CVE-2026-112403). A fixed version is available. Trust score: 40 → 0

    1000014
    5 followersView on X
  • MCP Scores@MCPScores

    🚨 Critical vulnerability io.github.kastro5/opendeck-mcp Unpatched critical vulnerability (CVE-2026-112403). A fixed version is available. Trust score: 81 → 0

    1000014
    5 followersView on X
  • MCP Scores@MCPScores

    🚨 Critical vulnerability com.travelanimator/mcp Unpatched critical vulnerability (CVE-2026-112403). A fixed version is available. Trust score: 74 → 0

    1000013
    5 followersView on X
  • MCP Scores@MCPScores

    🚨 Critical vulnerability io.github.AndrewKochulab/sim-mirror Unpatched critical vulnerability (CVE-2026-112403). A fixed version is available. Trust score: 83 → 0

    1000011
    5 followersView on X
  • MCP Scores@MCPScores

    🚨 Critical vulnerability io.github.docling-project/docling-rs Unpatched critical vulnerability (CVE-2026-112403). A fixed version is available. Trust score: 50 → 0

    1000014
    5 followersView on X
  • MCP Scores@MCPScores

    🚨 Critical vulnerability io.github.mituan-ai/paperbanana-cn Unpatched critical vulnerability (CVE-2026-112403). A fixed version is available. Trust score: 90 → 0

    1000085
    5 followersView on X

Explore more

Back to dashboard