Heap Buffer Overflow in Python Imaging Library Pillow Affects Specific Versions
CVE-2026-112394

6.3MEDIUM

Key Information:

Vendor

Python-pillow

Status
Pillow
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112394?

A vulnerability in the Pillow library allows an attacker to read beyond the end of an input buffer due to improper handling of raw decoders, specifically the P;2L and P;4L formats. This flaw can lead to potential information leakage by exposing up to three adjacent bytes from the heap in output pixels, or cause the application to crash. Users are advised to upgrade to version 13.0.0 or later, where this issue has been resolved, to ensure enhanced security.

Affected Version(s)

Pillow < 13.0.0

References

https://github.com/python-pillow/Pillow/security/advisori...
x_refsource_CONFIRM
https://github.com/python-pillow/Pillow/commit/392ee6f0d1...
x_refsource_MISC
https://github.com/python-pillow/Pillow/releases/tag/13.0.0
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.