CVE-2026-112893: Pillow Package Memory Safety Vulnerability in FreeType Glyph Rendering
Summary
CVE-2026-112893: Pillow: Invalid free in FreeType glyph rendering when a stroker is active. Affects pillow versions >= 10.0.0, < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a widely used Python Imaging Library that adds image processing capabilities to your Python interpreter. It supports opening, manipulating, and saving many different image file formats. However, it has a vulnerability related to FreeType glyph rendering when a stroker is active, which can lead to memory safety issues.
Vulnerability Detail
The vulnerability arises when Pillow draws text with a non-zero stroke width. It creates a FreeType stroker and loads each glyph. If the FT_Load_Glyph function fails for a glyph, the cleanup path incorrectly calls FT_Done_Glyph on an uninitialized variable, leading to potential invalid or double free errors. This issue can be exploited using a malformed font loaded from untrusted bytes, resulting in crashes or unexpected behavior. The vulnerability is classified as high severity with a CVSS score of 8.2.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using stroke_width greater than 0 when drawing text with Pillow, especially when using fonts from untrusted sources. This can help mitigate the risk until the package is updated.
Conclusion
In summary, CVE-2026-112893 is a critical vulnerability in the Pillow package that can lead to memory safety issues when rendering text with a non-zero stroke width. Users are advised to update to the latest version to mitigate risks associated with this vulnerability.
See every vulnerability recorded for pillow →
FAQ
CVE-2026-112893 is a vulnerability in the Pillow package that can lead to memory safety issues during FreeType glyph rendering.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update Pillow right away, avoid using stroke_width greater than 0 when drawing text to reduce the risk of exploitation.
The vulnerability has a high severity rating with a CVSS score of 8.2, indicating a significant risk to applications using the affected versions of Pillow.
You can find more information about Pillow and its features in the official documentation at https://pillow.readthedocs.io.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
