OESA-2026-4738: python-pillow security update

Q: Which applications are exposed to this issue?

Applications using Pillow versions from 10.0.0 up to, but not including, 13.0.0 may be exposed if they render text from attacker-controlled or otherwise untrusted font bytes with a nonzero stroke width.

Q: What does an attacker need to trigger the flaw?

An attacker needs to provide a malformed font to an application that passes the font to Pillow's FreeType rendering path while drawing text with an active, nonzero-width stroke. No privileges or user interaction are indicated by the supplied severity vector.

Q: What is the practical impact of successful exploitation?

The malformed font can force a glyph-loading failure that leads Pillow to free an invalid glyph pointer. This can corrupt process memory or crash the affected application.

Q: What version resolves the issue?

The issue is fixed in Pillow version 13.0.0. Systems running an earlier affected version should update to the security-fixed package when available.

Published Nov 11, 2026

Updated

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816) Security Fix(es):

Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FTLoadGlyph fails, cleanup may call FTDoneGlyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.(CVE-2026-112893)

Affected Software

1 affected componentFixes available

openeuler/python-pillow<9.0.1-18.oe2203sp4

9.0.1-18.oe2203sp4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/python-pillow to a version that resolves this vulnerability.
Fixed in 9.0.1-18.oe2203sp4
Upgrade
Upgrade python-pillow to a version that resolves this vulnerability.
Fixed in 13.0.0

Event History

Nov 11, 2026

Advisory Published

via OSV·12:25 PM

Data Sourced

via OSV·12:25 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-112893

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using Pillow versions from 10.0.0 up to, but not including, 13.0.0 may be exposed if they render text from attacker-controlled or otherwise untrusted font bytes with a nonzero stroke width.

What does an attacker need to trigger the flaw?

An attacker needs to provide a malformed font to an application that passes the font to Pillow's FreeType rendering path while drawing text with an active, nonzero-width stroke. No privileges or user interaction are indicated by the supplied severity vector.

What is the practical impact of successful exploitation?

The malformed font can force a glyph-loading failure that leads Pillow to free an invalid glyph pointer. This can corrupt process memory or crash the affected application.

What version resolves the issue?

The issue is fixed in Pillow version 13.0.0. Systems running an earlier affected version should update to the security-fixed package when available.

OESA-2026-4738: python-pillow security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to trigger the flaw?

What is the practical impact of successful exploitation?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to trigger the flaw?

What is the practical impact of successful exploitation?

What version resolves the issue?