Null Dereference Vulnerability in Pillow Imaging Library by Python
CVE-2026-112405

8.7HIGH

Key Information:

Vendor

Python-pillow

Status
Pillow
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112405?

Pillow, a widely-used Python imaging library, contains a vulnerability in the Image.merge() function where it fails to properly validate the first input band. This issue can lead to a null dereference, causing a native process crash, particularly when processing crafted IPTC files. The vulnerability is present in versions 12.0.0 through 13.0.0 and can be triggered by both direct calls to Image.merge() with a malformed first band or when an application opens and loads the crafted IPTC. The issue has been addressed in version 13.0.0.

Affected Version(s)

Pillow >= 12.0.0, < 13.0.0

References

https://github.com/python-pillow/Pillow/security/advisori...
x_refsource_CONFIRM
https://github.com/python-pillow/Pillow/commit/b6ee66e8b2...
x_refsource_MISC
https://github.com/python-pillow/Pillow/releases/tag/13.0.0
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.