Pillow versions prior to 13.0.0 contain a vulnerability where a double free of image memory can occur during certain image transform operations. This happens when ImagingScaleAffine encounters a selective allocation failure in a specific fast path for affine transformations using nearest neighbor resampling. The flaw can cause process crashes and potential memory corruption. The issue is fixed in Pillow version 13.0.0.
Pillow versions prior to 13.0.0 contain a critical vulnerability in the FlashPix JPEG-tile decoder. The decoder can write decoded scanlines beyond the allocated tile buffer due to improper handling of JPEG modes, leading to heap memory corruption. This flaw may allow an attacker to execute arbitrary code by supplying a crafted OLE2 FlashPix file to an application that processes untrusted input with the optional olefile dependency. The issue is fixed in Pillow version 13.0.0.
Pillow, a Python imaging library, has a vulnerability in versions prior to 13.0.0 where the ImageMorph.MorphOp.apply() function can access memory before a row buffer when processing zero-width images. This occurs because PPM and PGM inputs can create images with zero width, and the morphology routine improperly indexes memory without rejecting this geometry. An attacker can exploit this by supplying a crafted image, causing the application to crash. The issue is fixed in version 13.0.0.
Pillow versions from 11.3.0 up to but not including 13.0.0 contain a heap use-after-free vulnerability triggered when libtiff rejects a tag during TIFF encoding to an in-memory buffer. This flaw can cause a process crash and may allow code execution. The issue is resolved in Pillow version 13.0.0.
Pillow, a Python imaging library, has a vulnerability in versions prior to 13.0.0 where rank-based filters can dereference invalid image storage when processing a zero-size image. This flaw causes a native process crash due to a fault in the ImagingExpand() function before the rank filter is applied. The issue is resolved in version 13.0.0.
CVE-2026-112901 is a medium severity vulnerability in the Pillow Python imaging library affecting versions prior to 13.0.0. The issue relates to the handling of XBM image headers. It has a CVSS 4.0 base score of 6.9, indicating a network exploitable vulnerability with low attack complexity and no required privileges or user interaction. No public exploits or known active exploitation have been reported. The affected versions include various Ubuntu package builds of Pillow up to version 3.0.0-1build1.
A critical vulnerability (CVE-2026-112900) affects the Pillow Python imaging library versions from 2.6.0 up to but not including 13.0.0. The vulnerability has a high CVSS 4.0 score of 9.2, indicating severe impact with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Specific technical details and exploit methods are not provided in the available data.
A medium severity vulnerability (CVE-2026-112898) affects the Pillow Python imaging library versions from 9.1.0 up to but not including 13.0.0. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a network exploitable issue with low impact on confidentiality. No public exploits or known active exploitation have been reported. The affected versions include various Ubuntu package builds of Pillow. No patch or remediation details are provided in the available data.
A high-severity vulnerability (CVE-2026-112897) affects the Pillow Python imaging library versions from 5.3.0 up to but not including 13.0.0. The vulnerability has a CVSS 4.0 base score of 8.7, indicating a significant security risk. The flaw allows for a high impact on confidentiality without requiring privileges or user interaction. Multiple Ubuntu package versions are listed as affected. No public exploits or vendor patch information are provided in the data.
CVE-2026-112896 is a high-severity vulnerability in the Pillow Python imaging library affecting TIFF encoding prior to version 13.0.0. The flaw allows an attacker to cause a high-impact security issue without requiring privileges or user interaction. Multiple Ubuntu package versions of Pillow are affected.
A high-severity vulnerability (CVE-2026-112895) affects the Pillow Python imaging library versions from 5.1.0 up to but not including 13.0.0. The vulnerability has a CVSS 4.0 base score of 8.7, indicating a significant security risk. The affected versions include multiple Ubuntu package builds of Pillow. No public exploits or vendor patch information are provided in the data.
A high-severity vulnerability (CVE-2026-112894) affects the Pillow Python imaging library versions from 5.1.0 up to 13.0.0. The vulnerability has a CVSS 4.0 score of 8.7, indicating a significant security risk. The flaw allows for a high impact without requiring privileges or user interaction. Multiple Ubuntu package versions of Pillow are affected. No public exploits or patches are currently documented in the provided data.
A high-severity vulnerability (CVE-2026-112893) affects the Pillow Python imaging library versions from 10.0.0 up to 13.0.0. The vulnerability has a CVSS 4.0 base score of 8.2, indicating a network exploitable issue with high impact. The affected versions include several Ubuntu package builds of Pillow. No public exploits or vendor patch information are provided in the data.
Pillow, a Python imaging library, contains a high-severity vulnerability affecting versions from 4.1.0 up to 13.0.0. The vulnerability has a CVSS 4.0 base score of 8.7, indicating a significant security risk. Specific details about the nature of the vulnerability are not provided in the available data. Multiple Ubuntu package versions are listed as affected. No public exploits or known active exploitation have been reported. Patch status is not confirmed due to lack of vendor advisory or patch information.
A medium severity vulnerability (CVE-2026-112891) affects the Pillow Python imaging library versions from 9.2.0 up to but not including 13.0.0. The CVSS 4.0 base score is 6.9, indicating a network exploitable issue with low impact on availability and no user interaction required. Specific technical details and impact vectors are limited in the provided data.
A high-severity vulnerability (CVE-2026-112406) affects the Pillow Python imaging library versions from 5.1.0 up to 13.0.0. The vulnerability has a CVSS 4.0 base score of 8.7, indicating a significant security risk. The flaw allows an attacker to cause a high impact without requiring privileges, user interaction, or vector complexity. Multiple Ubuntu package versions of Pillow are affected. No public exploits or vendor patch information are provided in the input data.
CVE-2026-112405 is a high-severity vulnerability affecting the Pillow Python imaging library versions from 12.0.0 up to but not including 13.0.0. The vulnerability has a CVSS 4.0 base score of 8.7, indicating a significant security risk. The flaw allows for a high impact without requiring privileges, user interaction, or complex attack conditions. No public exploits or known active exploitation have been reported. The affected versions include multiple Ubuntu package builds of Pillow. No patch or remediation details are provided in the available data.
Pillow, a Python imaging library, contains a high-severity vulnerability identified as CVE-2026-112404 affecting versions from 8.1.0 up to but not including 13.0.0. The vulnerability has a CVSS 4.0 base score of 8.8, indicating a network-exploitable flaw with low attack complexity and no required privileges or user interaction. The impact is high, with a vulnerability that can cause significant harm if exploited. There are no known exploits in the wild, and the affected versions include specific Ubuntu package versions listed. No patch or remediation details are provided in the available data.
A critical vulnerability exists in Pillow, a Python imaging library, affecting versions prior to 13.0.0. The issue relates to the JPEG decoder component. The vulnerability has a high CVSS 4.0 score of 9.2, indicating significant potential impact. No public exploits or detailed technical descriptions are provided. The affected versions include multiple Ubuntu package builds of Pillow from 2.2.1 through 3.0.0. No patch or remediation details are included in the data.