Memory Corruption Vulnerability in Pillow Python Imaging Library
CVE-2026-112893

8.2HIGH

Key Information:

Vendor

Python-pillow

Status
Pillow
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112893?

The Pillow library, a popular Python imaging tool, is vulnerable to potential memory corruption due to improper handling of invalid glyph pointers during FreeType rendering when utilizing an active stroker. If the FT_Load_Glyph function fails, the cleanup process may mistakenly call FT_Done_Glyph on either an uninitialized or stale glyph variable. This allows an attacker to leverage malformed font data, triggering a glyph-load failure and resulting in the application crashing or corrupting memory. The issue has been resolved in Pillow version 13.0.0.

Affected Version(s)

Pillow >= 10.0.0, < 13.0.0

References

https://github.com/python-pillow/Pillow/security/advisori...
x_refsource_CONFIRM
https://github.com/python-pillow/Pillow/commit/a7416de7f3...
x_refsource_MISC
https://github.com/python-pillow/Pillow/releases/tag/13.0.0
x_refsource_MISC

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.