Image Processing Library Vulnerability in Pillow - Python Imaging Library

CVE-2026-112392

What is CVE-2026-112392?

Pillow, a widely-used Python imaging library, has a vulnerability that affects its handling of zero-size images in versions prior to 13.0.0. Specifically, when applying rank-based filters like median, minimum, or maximum, the library attempts to process a zero-size image by allocating a non-empty output. This leads to a fault, as the library tries to read the first pixel from empty input storage, causing a native process crash. The issue has been addressed in version 13.0.0, and users are advised to update to mitigate associated risks.

References