CVE-2026-112392: Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter is never reached. An attacker can supply or cause creation of a zero-size image to an application that applies a rank, median, minimum, or maximum filter. This causes a native process crash. This issue is fixed in version 13.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pillowto a version that resolves this vulnerability.Fixed in 13.0.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Pillow versions before 13.0.0 are exposed if they apply rank-based filters, including rank, median, minimum, or maximum filters, to images that may have zero width or height.
What does an attacker need to do to trigger the crash?
An attacker must be able to supply a zero-size image, or cause the application to create one, and have the application process it with an affected rank-based filter. No privileges or user interaction are required according to the provided CVSS vector.
What is the impact of successful exploitation?
The affected native process crashes because edge replication reads the first pixel from empty image storage. The provided CVSS vector identifies availability impact only, with no stated confidentiality or integrity impact.
What version fixes the issue?
Upgrade Pillow to version 13.0.0, which fixes the invalid storage dereference.