CVE-2026-112405: Pillow Package Suffers from NULL Pointer Dereference in Image.merge
Summary
CVE-2026-112405: Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0. Affects pillow versions >= 12.0.0, < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a widely-used Python Imaging Library that provides extensive capabilities for opening, manipulating, and saving various image file formats. It supports numerous image processing tasks, including image creation, filtering, and transformation. However, a vulnerability has been identified in the Image.merge function, which can lead to a crash when handling specific image formats, particularly when band 0 is a single-band image.
Vulnerability Detail
The vulnerability arises from the Image.merge() function, which fails to validate band 0 of the input bands. When band 0 is a single-band 'I' or 'F' image, the merge routine attempts to access a pixel pointer that is NULL, resulting in a segmentation fault and crashing the application. This issue is particularly exploitable through the IPTC plugin, which can be triggered by opening a crafted image file that lacks a recognizable header. The crash occurs in the C extension of Pillow, making it a severe issue that can lead to application downtime.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the Image.merge function with images that may have a single-band 'I' or 'F' format until you can update to the patched version. Additionally, validate the input images to ensure they have recognizable headers before processing.
Conclusion
The identified vulnerability in the Pillow package poses a significant risk due to the NULL pointer dereference in the Image.merge function. It is crucial for users to update to the patched version to mitigate the risk of application crashes. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for pillow →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without needing to sign up.
The vulnerability primarily affects single-band 'I' or 'F' images when used as band 0 in the Image.merge function.
If you do not update the Pillow package, your application may experience crashes when processing specific image files, leading to potential downtime and loss of functionality.
While the vulnerability causes a crash, it does not directly lead to data loss. However, it can disrupt application functionality and user experience.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
