Pillow Python Library Patch Fixes High-Severity Memory Access Flaw
A zero-width image processing error in Pillow versions before 13.0.0 allows attackers to crash applications. The vendor has released a fix for this high-severity vulnerability.
Key points
- Pillow versions prior to 13.0.0 contain a high-severity memory access vulnerability.
- The flaw allows attackers to crash processes via specially crafted PPM or PGM images.
- The issue is resolved in the newly released version 13.0.0 of the library.
Organizations using the Pillow Python imaging library must upgrade to version 13.0.0 to address a high-severity vulnerability. The flaw, tracked as CVE-2026-112397, allows attackers to crash applications by supplying images with zero width. This issue affects all Pillow versions released before the 13.0.0 update. The National Vulnerability Database rates the severity as high with a CVSS score of 8.7.
How it unfolded
- The National Vulnerability Database recorded CVE-2026-112397 with a CVSS score of 8.7.
- Researchers identified that Pillow's ImageMorph.MorphOp.apply() function fails to handle zero-width images correctly.
- The vendor released version 13.0.0 to fix the out-of-bounds memory access issue.
Who is affected
The vulnerability impacts any application that uses the Pillow library for image processing. Specifically, the flaw exists in the native morphology routine within the ImageMorph module. When an application applies a morphology operation to an image with a width of zero, the routine attempts to access memory before the row buffer. This occurs because the code indexes outrow[width - 1] without first rejecting the invalid geometry.
Attackers can exploit this by providing PPM or PGM input files that create images with zero width. If the target application processes these files using the affected morphology functions, the process can crash. This issue is present in all Pillow versions prior to 13.0.0.
Our take on the response
The vendor has provided a clear remediation path by releasing version 13.0.0. This update addresses the root cause of the memory access error. The high severity rating reflects the potential for service disruption. Users should prioritize upgrading to this version to eliminate the risk.
Who needs to act first
Teams should immediately identify all systems running Pillow versions older than 13.0.0. Prioritize updating public-facing applications that process user-uploaded images. Before rolling out the update in production environments, test the new library version in a staging area to ensure compatibility. Verify that existing image processing workflows function correctly after the upgrade. Monitor application logs for any unusual crashes during the transition period.
What to do and how to stay safe: Pillow
- Inventory all servers and containers to locate installations of Pillow versions prior to 13.0.0.
- Upgrade the Pillow library to version 13.0.0 or later on all affected systems.
- Review application code to identify any custom image processing that might bypass standard library checks.
- Monitor system logs for unexpected application crashes that could indicate exploitation attempts.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-112397?
The National Vulnerability Database rates the vulnerability as high with a CVSS score of 8.7.
Which image formats can trigger this vulnerability?
PPM and PGM input files can create images with zero width that trigger the memory access error.
Is there a patch available for this issue?
Yes, the issue is fixed in version 13.0.0 of the Pillow Python imaging library.
