CVE-2026-112405: Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC file can reach this path when an application opens and loads it, or a caller can invoke Image.merge() directly with such a first band. This causes a native process crash. This issue is fixed in version 13.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pillowto a version that resolves this vulnerability.Fixed in 13.0.0
Event History
Frequently Asked Questions
Which deployments are exposed to attacker-controlled input?
Applications using Pillow 12.0.0 through versions before 13.0.0 are exposed if they open and load crafted IPTC files. The issue can also be triggered by application code that directly calls Image.merge() with a maliciously constructed first band.
What is the practical impact of successful exploitation?
Successful exploitation causes a NULL pointer dereference in native code, resulting in a process crash. The provided CVSS vector indicates availability impact only, with no stated confidentiality or integrity impact.
Does exploitation require authentication or user interaction?
No. The supplied CVSS vector indicates network reachability, low attack complexity, no privileges required, and no user interaction; however, the affected application must process the crafted IPTC file or invoke the vulnerable Image.merge() path.
What version resolves the issue?
Upgrade Pillow to version 13.0.0, which fixes the issue. The affected range begins at 12.0.0 and ends before 13.0.0.