CVE-2026-112402

HighCVSS 7.5/10Last modified Oct 27, 2026

Description

Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST resampling. The output image allocation must succeed while the additional per-column lookup allocation fails, after which the error path deletes image storage that later cleanup releases again. An attacker who can drive such a large Image.transform() operation under memory pressure may trigger the failure. This can crash the process and may corrupt memory. This issue is fixed in version 13.0.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
python-pillow	Pillow	< 13.0.0

References

https://github.com/python-pillow/Pillow/commit/aafa6c75f7cdabb9f409a8aac7c780bea31d08d9Patch
https://github.com/python-pillow/Pillow/releases/tag/13.0.0Release Notes
https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrmExploit, Mitigation, Patch, Vendor Advisory
https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrmExploit, Mitigation, Patch, Vendor Advisory

Timeline

Published: Oct 19, 2026
Last modified: Oct 27, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1124039.8Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a request CVE-2026-1124048.2Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by l CVE-2026-1124057.5Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips t CVE-2026-1124067.5Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_CVE-2026-1124078.8Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authen CVE-2026-1124088.1Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 a CVE-2026-112418.0Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment CVE-2026-1124107.5A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macO CVE-2026-1124136.5An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS CVE-2026-1124146.5A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2 CVE-2026-1124156.5An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadO CVE-2026-1124165.5An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and