VDB
CVE-2026-112402
CVE-2026-112402
PUBLISHED
CVSS 8.7 HIGH
Reported by GitHub_M · Published October 19, 2026
Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST resampling. The output image allocation must succeed while the additional per-column lookup allocation fails, after which the error path deletes image storage that later cleanup releases again. An attacker who can drive such a large Image.transform() operation under memory pressure may trigger the failure. This can crash the process and may corrupt memory. This issue is fixed in version 13.0.0.
Risk Scores
CVSS 4.0
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| python-pillow | Pillow | < 13.0.0 |
| chainguard | openstack-horizon-2025.2 | 0 |
| chainguard | nemo-gym | 0 |
| chainguard | nemo-rl-cuda-13.0 | 0 |
| chainguard | py3-pytorch-cuda-13.0 | 0 |
| PyPI | Pillow | 0 |
| python-pillow | Pillow | 0 |
| chainguard | py3-pillow | 0 |
| chainguard | superset-fips-6.1 | 0 |
| chainguard | apache-beam-python-3.12-sdk | 0 |
| wolfi | py3-pillow | 0 |
| chainguard | open-webui | 0 |
| wolfi | open-webui | 0 |
Timeline
- Oct 19, 2026 CVE Published
- Oct 19, 2026 CVE Updated
- Oct 20, 2026 EPSS Score
- Oct 20, 2026 Coalition ESS Score
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
- Oct 30, 2026 Distribution Patch
- Oct 30, 2026 Security Advisory
- Oct 30, 2026 Security Advisory
- Oct 31, 2026 EPSS Score
References
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm x_refsource_CONFIRM
- https://github.com/python-pillow/Pillow/commit/aafa6c75f7cdabb9f409a8aac7c780bea31d08d9 x_refsource_MISC
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-112402 advisory
- https://github.com/advisories/GHSA-7mwm-ghpf-9vrm advisory