CVE-2026-112394: Pillow Buffer Overread Vulnerability in P;2L and P;4L Decoders
Summary
CVE-2026-112394: Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size. Affects pillow versions < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a widely-used Python Imaging Library (PIL) that adds image processing capabilities to your Python interpreter. It supports opening, manipulating, and saving many different image file formats. The library is essential for developers working with images in Python, offering features such as image filtering, transformation, and format conversion. However, a vulnerability has been identified in the P;2L and P;4L decoders, which may lead to unintended memory access.
Vulnerability Detail
The vulnerability arises from a mismatch in how the ImagingRawDecode function and the P;2L and P;4L unpackers calculate the size of data lines. Specifically, the unpackers can read 1 to 3 bytes beyond the allocated buffer size, potentially leading to heap memory overreads. This can result in the mixing of unintended data into the decoded image or even crashes if the read accesses unmapped memory. The issue is present in all published versions of Pillow prior to 13.0.0.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to update to the patched version as soon as possible to mitigate the risk.
Conclusion
The CVE-2026-112394 vulnerability in the Pillow library poses a risk of memory overreads in specific decoders. Users are advised to update to version 13.0.0 or later to ensure their applications are secure. Regular monitoring for vulnerabilities, such as through Vulert, can help maintain application integrity.
See every vulnerability recorded for pillow →
FAQ
CVE-2026-112394 is a vulnerability in the Pillow library that allows P;2L and P;4L decoders to read beyond the allocated buffer size, potentially leading to memory overreads.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unintended data being mixed into decoded images or crashes due to accessing unmapped memory, which can compromise application stability.
Yes, a patch is available in Pillow version 13.0.0 and later. It is recommended to upgrade to this version to mitigate the vulnerability.
The CVSS score of this vulnerability is 6.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
