CVE-2026-112397: Pillow Zero-Width Image Causes Out-of-Bounds Access
Summary
CVE-2026-112397: Pillow: Out-of-bounds access in _imagingmorph on a zero-width image. Affects pillow versions < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a widely used Python Imaging Library that provides easy-to-use methods for opening, manipulating, and saving various image file formats. It supports a range of operations, including image processing and morphological transformations. However, it is vulnerable to a specific issue where it accepts images with a declared width of zero, leading to potential crashes and memory corruption when certain operations are performed.
Vulnerability Detail
The vulnerability arises from the Pillow library's PPM and PGM file parsers, which do not enforce a lower-bound check on the width of the image. This allows for the creation of a zero-width image, which can lead to out-of-bounds access when the MorphOp.apply() method is called. Specifically, the native code attempts to index a row buffer at outrow[width - 1], resulting in an attempt to access an invalid memory location. This can cause segmentation faults and potential memory corruption, particularly when processing untrusted input.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing images that may have a width of zero. You can implement a check in your code to validate the dimensions of images before passing them to the MorphOp.apply() method. For example:
from PIL import Image, ImageMorph
im = Image.new("L", (0, 5))
if im.width > 0:
ImageMorph.MorphOp(op_name="dilation4").apply(im)
else:
print('Image width is zero, skipping operation.')
Conclusion
The CVE-2026-112397 vulnerability in the Pillow library poses a significant risk due to its potential for causing crashes and memory corruption when handling zero-width images. It is crucial for developers to update to the latest version of Pillow and implement necessary checks in their applications to mitigate this risk.
See every vulnerability recorded for pillow →
FAQ
CVE-2026-112397 is a vulnerability in the Pillow library that allows for out-of-bounds access when processing zero-width images, potentially leading to crashes and memory corruption.
If your application uses Pillow versions 12.3.0 or earlier and processes images from untrusted sources, it may be affected. You can check your application's dependencies using tools like Vulert.
The CVSS score for this vulnerability is 8.7, indicating a high severity level.
If you cannot update Pillow, implement checks in your code to ensure that images being processed have valid dimensions, specifically that the width is greater than zero.
You can find more information about CVE-2026-112397 on the official GitHub advisory page or by using Vulert to monitor your dependencies for vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
