CVE-2026-112392: Pillow Package NULL Dereference Vulnerability in ImagingExpand Function
Summary
CVE-2026-112392: Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images. Affects pillow versions < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a widely-used Python Imaging Library (PIL) that adds image processing capabilities to your Python interpreter. It supports opening, manipulating, and saving many different image file formats. This library is essential for developers who need to handle images in their applications. However, it is vulnerable to a NULL dereference issue when applying rank filters to zero-size images, which can lead to application crashes.
Vulnerability Detail
The vulnerability arises in the ImagingExpand function within the Pillow library, specifically when applying median, minimum, maximum, or rank filters to images with zero width or height. Instead of raising an error, the function attempts to read pixel data from a NULL pointer, causing the Python process to crash with a SIGSEGV signal. This issue can be exploited by attackers who can provide user-supplied crop coordinates or upload files, leading to denial of service without memory disclosure or corruption. The vulnerability has existed since the original PIL import and affects all versions up to 12.3.0.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a check in your code to ensure that the image size is greater than zero before applying any rank filters. For example:
from PIL import Image, ImageFilter
im = Image.new('L', (10, 10)).crop((3, 0, 3, 10)) # This creates a zero-width image
if im.size[0] > 0 and im.size[1] > 0:
result = im.filter(ImageFilter.MedianFilter(3))
else:
result = im # Return the original image or handle as needed
Conclusion
The CVE-2026-112392 vulnerability in the Pillow library poses a significant risk by allowing application crashes due to NULL dereference when processing zero-size images. It is crucial for developers to update to the patched version 13.0.0 to mitigate this risk. Implementing checks in the code can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for pillow →
FAQ
CVE-2026-112392 is a vulnerability in the Pillow library that allows for a NULL dereference when applying rank filters to zero-size images, leading to application crashes.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The primary impact is denial of service, where the application crashes instead of handling the error gracefully. This can disrupt service availability for users.
Yes, the vulnerability is patched in Pillow version 13.0.0. Updating to this version will resolve the issue.
If immediate updating is not possible, implement a check in your code to ensure that images have non-zero dimensions before applying filters, as shown in the provided workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
