A high-severity vulnerability (CVE-2026-112400) affects the Pillow Python imaging library versions from 9.2.0 up to but not including 13.0.0. The vulnerability has a CVSS 4.0 base score of 8.7, indicating a significant security risk. The affected versions include multiple Ubuntu package builds of Pillow. No public exploits or known active exploitation have been reported. The vulnerability allows remote network attackers to cause a high impact without requiring privileges or user interaction.
A high-severity vulnerability (CVE-2026-112399) affects the Pillow Python imaging library versions from 8.1.0 up to 13.0.0. The vulnerability has a CVSS 4.0 base score of 8.7, indicating it is exploitable remotely without authentication and requires no user interaction. The specific impact details are not fully described in the input data. Multiple Ubuntu package versions of Pillow are listed as affected. No public exploits or patch information are provided.
A critical vulnerability (CVE-2026-112398) affects the Pillow Python imaging library in versions prior to 13.0.0. The flaw is related to the handling of FlashPix files. It has a high CVSS 4.0 score of 9.2, indicating severe impact potential. No public exploits or vendor patch information are provided in the data. The affected versions include multiple Ubuntu package builds of Pillow versions 2.2.1, 2.3.0, 2.9.0, and 3.0.0. The vulnerability is network exploitable but requires high attack complexity and no privileges or user interaction. No cloud service is involved.
A high-severity vulnerability (CVE-2026-112397) affects the Pillow Python imaging library in versions prior to 13.0.0. The vulnerability allows for a significant impact without requiring user interaction or privileges. It is identified with a CVSS 4.0 score of 8.7, indicating a network exploitable flaw with high impact on availability. Multiple Ubuntu package versions of Pillow are affected. No public exploits or vendor patches are explicitly stated in the provided data.
A vulnerability exists in the Pillow Python imaging library affecting versions from 11.3.0 up to but not including 13.0.0. The flaw has a CVSS 3.1 base score of 5.9, indicating a medium severity issue primarily impacting availability. The vulnerability does not affect confidentiality or integrity but can cause denial of service. No public exploits or known active exploitation have been reported. The affected versions include various Ubuntu package builds of Pillow. No explicit patch or remediation details are provided in the available data.
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as output pixel indices. An attacker who controls the palette image can obtain stack contents from a returned PNG or GIF. This can disclose addresses and stack-canary data without an out-of-bounds access, memory corruption, or process crash. This issue is fixed in version 13.0.0.
A use of uninitialized resource vulnerability exists in the python-pillow Pillow library versions 5.3.0 through 12.x. Pillow can return uninitialized memory as pixel data when decoding certain JPEG-compressed or Group 4 fax TIFF images. This occurs because the decoding buffers may be larger than the data written by libtiff, and the unwritten buffer tail is not cleared. An attacker can exploit this by supplying a crafted TIFF file to disclose stale heap memory contents. The issue is fixed in Pillow version 13.0.0.
CVE-2026-112895 is a high-severity vulnerability in the python-pillow Pillow library affecting versions from 5.1.0 up to but not including 13.0.0. It involves uncontrolled recursion in PDF parsing when appending to existing PDFs using Image.save with append=True. The PdfParser's linearize_page_tree function recurses through /Kids references without cycle or depth checks, allowing cyclic or duplicated page trees to cause unbounded recursion. Similarly, read_prev_trailer only guards against exact repeated offsets, permitting long unique chains to recurse deeply. This can lead to excessive CPU and memory consumption or a RecursionError, resulting in denial of service in applications processing user-supplied PDFs. The issue is fixed in Pillow 13.0.0 by adding a visited set and depth limit to the parsers.
CVE-2026-112894 is a high-severity vulnerability in the python-pillow Pillow library affecting versions from 5.1.0 up to but not including 13.0.0. It causes a quadratic-time denial-of-service (DoS) when saving multi-frame images as multi-page PDFs due to inefficient algorithmic complexity in the PDF writer's object ID reservation process. This inefficiency leads to excessive CPU usage proportional to the square of the frame count, allowing an attacker to tie up system resources for extended periods with crafted files. The issue was fixed in version 13.0.0.
Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.
A server-side request forgery (SSRF) vulnerability exists in ptbsare anx-calibre-manager up to version 1.13.12. The flaw is in the LLMClient.chat function within the blueprints/api/llm.py file, specifically in the LLM Configuration Handler component. This vulnerability allows remote attackers to manipulate the base_url argument, potentially causing SSRF. The vulnerability has a low CVSS score of 4.3. The vendor was contacted but did not respond, and no patch or remediation is currently available. Exploit code has been published but there is no evidence of active exploitation in the wild.
CVE-2026-112892 is a high-severity vulnerability in the python-pillow Pillow library affecting versions from 4.1.0 up to but not including 13.0.0. The issue involves the MSP RLE decoder, which can expand a small crafted MSP image into an unbounded in-memory buffer, leading to memory exhaustion and denial of service. This occurs because the decoder writes run-length output to BytesIO without limiting expansion to the declared image size, bypassing decompression-bomb checks. The vulnerability is fixed in version 13.0.0.
CVE-2026-112891 is a vulnerability in the python-pillow Pillow library versions 9.2.0 up to but not including 13.0.0. It involves inefficient algorithmic complexity in handling GIF images with long comments, causing repeated copying of comment portions during saving. This can lead to CPU resource exhaustion and a denial of service if crafted images are processed automatically by a network service. The issue is fixed in version 13.0.0.
CVE-2026-112406 is an infinite loop vulnerability in the python-pillow library's PDF parser component. Specifically, the flaw occurs in the PdfParser.rewrite_pages() function when processing a PDF file with a cyclic page tree /Parent reference. This causes the library to hang indefinitely at 100% CPU when appending an image to such a PDF using the append=True option. The issue affects Pillow versions from 5.1.0 up to but not including 13.0.0.
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not verify that the required input row fits inside the row libtiff produced, while the strip path has this validation. Loading pixels from such a crafted TIFF can expose adjacent heap data in output pixels or crash the process. This issue is fixed in version 13.0.0.
A heap-based buffer overflow vulnerability exists in Pillow's JPEG decoder prior to version 13.0.0. The flaw occurs when decoding certain 8-bit lossless SOF3 JPEG images using libjpeg-turbo 3.x, which can ignore requested downscaling geometry, leading to buffer overflow. This can cause heap corruption, application crashes, or potentially allow code execution. The issue is fixed in Pillow version 13.0.0.
CVE-2026-112402 is a high-severity double free vulnerability in the python-pillow Pillow library affecting versions prior to 13.0.0. The flaw occurs in the ImagingScaleAffine function during Image.transform() when a memory allocation for a lookup table fails, leading to a double free of the output image's memory. This causes a crash (SIGSEGV) and heap corruption in processes with memory limits or 32-bit environments. The vulnerability has been present since Pillow 1.0 and is fixed in version 13.0.0.
CVE-2026-112392 is a NULL pointer dereference vulnerability in the python-pillow Pillow library affecting versions prior to 13.0.0. The flaw occurs in the ImagingExpand function when applying median, minimum, maximum, or rank filters to zero-width or zero-height images, causing the Python process to crash with a segmentation fault. This happens because the function attempts to read edge pixels without verifying that the image contains any pixels, leading to a NULL pointer dereference. The issue can be triggered by supplying crafted crop coordinates or multi-page TIFF files with zero-length pages. The vulnerability results in denial of service by crashing the process, with no memory corruption or data disclosure. A fix is available in Pillow version 13.0.0.
Pillow, a Python imaging library, has a vulnerability in versions prior to 13.0.0 where its P;2L and P;4L raw decoders can read beyond the end of an input buffer. This flaw allows disclosure of up to three adjacent heap bytes or can cause a crash. The issue arises because the unpackers read padded bit planes separately, potentially exceeding the buffer size calculated by ImagingRawDecode. This vulnerability is fixed in version 13.0.0.