CVE-2026-112397: Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[width - 1] without rejecting that geometry. An attacker can supply such an image to an application that applies a morphology operation. This can crash the process. This issue is fixed in version 13.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pillowto a version that resolves this vulnerability.Fixed in 13.0.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Pillow before 13.0.0 are exposed if they process attacker-supplied PPM or PGM images and apply ImageMorph.MorphOp.apply() to them. The triggering image must have zero width.
What does an attacker need to do to trigger the vulnerability?
An attacker needs to provide a crafted PPM or PGM image that creates a zero-width image and cause the application to apply a morphology operation. No authentication or user interaction is required according to the supplied CVSS vector.
What is the expected impact of successful exploitation?
The documented impact is a process crash caused by access before a row buffer in the native morphology routine. The supplied CVSS vector indicates impact to availability, with no stated confidentiality or integrity impact.
What should teams do to remediate the issue?
Upgrade Pillow to version 13.0.0, which fixes the issue. If upgrading is not immediately possible, avoid applying morphology operations to untrusted PPM or PGM inputs and reject zero-width images before calling ImageMorph.MorphOp.apply().