CVE-2026-112394 in Pillow
Summary
by MITRE • 10/20/2026
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can read past the end of an input buffer. ImagingRawDecode calculates a packed-pixel row size, while the unpackers read separately padded bit planes. A caller can supply a buffer and image dimensions whose accepted size is smaller than the unpacker's actual footprint. This can disclose up to three adjacent heap bytes in output pixels or crash the process. This issue is fixed in version 13.0.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in Pillow, specifically affecting versions prior to 13.0.0, represents a critical memory safety flaw within the image processing library's handling of palette-based pixel formats. Pillow serves as a foundational component for many Python applications dealing with computer vision and digital media manipulation, making this issue particularly significant due to its widespread adoption across diverse software ecosystems. The core technical deficiency lies in the implementation of the P;2L and P;4L raw decoders, which are responsible for interpreting 1-bit and 4-bit palette-indexed image data respectively. These formats rely on a specific memory layout where pixel values are packed into bits within bytes, requiring precise calculation of row sizes to ensure that decoding operations remain within allocated buffer boundaries.
The fundamental technical flaw stems from a discrepancy between how the imaging engine calculates the required size for a packed-pixel row and how the underlying unpackers interpret padded bit planes during execution. When processing these specific pixel formats, the decoder computes an expected footprint based on standard packing rules, but the actual memory access patterns performed by the unpacking logic do not strictly adhere to this calculated limit under certain conditions. Specifically, if a caller supplies an input buffer and associated image dimensions where the accepted size is smaller than what the unpacker actually requires for its internal operations, the decoder fails to perform adequate bounds checking before initiating the read operation. This architectural mismatch allows the decoding routine to traverse beyond the allocated memory region of the provided buffer.
The operational impact of this out-of-bounds read vulnerability is twofold, presenting both confidentiality and availability risks to systems relying on Pillow for image processing. In terms of confidentiality, an attacker who can control or influence the input parameters such as buffer size and dimensions may trigger a heap-based information disclosure. The decoder reads up to three adjacent bytes from memory locations immediately following the end of the intended output pixels. These leaked bytes could contain sensitive data previously stored in that region of the heap, potentially exposing cryptographic keys, session tokens, or other private application state depending on what was allocated nearby at runtime. This aligns with CWE-125, which describes out-of-bounds read vulnerabilities where software reads past the end of a buffer.
From an availability perspective, the vulnerability can lead to process crashes if the memory access triggers segmentation faults or raises exceptions that are not gracefully handled by the hosting application. While heap over-reads do not typically allow for direct code execution like overflow vulnerabilities, they destabilize the runtime environment and can be leveraged in denial-of-service attacks against services processing untrusted image uploads. The ability to crash a service through malformed input is consistent with CWE-126, which covers buffer over-read scenarios that lead to system instability or crashes. Furthermore, this type of memory corruption issue maps directly to MITRE ATT&CK technique T1083, File and Directory Discovery, as the leaked data could be used by an attacker to map out the application's memory layout for further exploitation attempts such as heap spraying or information gathering prior to more severe attacks like arbitrary code execution.
Mitigation strategies primarily involve upgrading Pillow to version 13.0.0 or later, where this discrepancy in buffer boundary calculations has been resolved through rigorous validation of input dimensions against actual decoding requirements. For organizations unable to immediately patch their dependencies, defensive coding practices should be implemented at the application layer by validating image metadata and ensuring that all buffers passed to imaging libraries are sufficiently sized relative to declared dimensions. Additionally, deploying runtime protection mechanisms such as Address Sanitizer during testing phases can help identify similar boundary violations in custom integrations of Pillow. Regular dependency audits using tools like Snyk or Dependabot are recommended to maintain visibility over known vulnerabilities in third-party image processing components and ensure timely updates when patches become available for critical libraries like Pillow.