{"id":"CVE-2026-112397","aliases":["GHSA-58r4-6rv3-gfh8","BIT-pillow-2026-112397","PYSEC-2026-4329"],"title":"Pillow: Out-of-bounds access in _imagingmorph on a zero-width image","summary":"Pillow: Out-of-bounds access in _imagingmorph on a zero-width image","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"pillow","product":"pillow","ecosystem":"pip","affected":["pillow < 13.0.0"],"patched":["pillow 13.0.0"],"published":"2026-10-20","updated":"2026-10-28","sourceUpdated":"2026-10-28T11:10:53.627071818Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-58r4-6rv3-gfh8","references":[{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-58r4-6rv3-gfh8"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112397"},{"url":"https://github.com/python-pillow/Pillow/commit/18f7c0dfee93063c51db6ed0ca8c4da2999dcb64"},{"url":"https://github.com/python-pillow/Pillow"},{"url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112397.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-112397"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555868"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-112397"},{"url":"https://github.com/advisories/GHSA-58r4-6rv3-gfh8"}],"tags":["osv","pip","csaf","vex","red-hat","ghsa","cve.org","exploit-available"],"cvssSource":"osv","epss":0.00573,"epssPercentile":0.47212,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-19T21:37:56.314774Z"},"cwe":["CWE-124","CWE-787"],"scores":{"osv":7.5,"vendor":7.5,"cna":8.7},"ingestedAt":"2026-10-19T21:43:56.110Z","slug":"CVE-2026-112397","body":"## Overview\n\n### Summary\nA PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size `(0, N)`. Passing that image to `ImageMorph.MorphOp.apply()` makes the native morphology code index a row buffer at `outrow[width - 1]`, which is `outrow[-1]` when the width is 0. The process crashes.\n\n### Details\nThe PPM parser reads width and height with no lower-bound check:\n\n- `src/PIL/PpmImagePlugin.py:119`\n\nThe native `apply()` writes the row edges with no guard that the width is positive:\n\n- `src/_imagingmorph.c:81` sets `outrow[0] = outrow[width - 1] = 0;`\n\n`match()` and `get_on_pixels()` use the same edge-indexing pattern.\n\n### PoC\n```python\nfrom PIL import Image, ImageMorph\n\n# A width-0 image (also producible from a crafted PPM header). apply() indexes\n# outrow[width - 1] == outrow[-1] in native code.\nim = Image.new(\"L\", (0, 5))\nImageMorph.MorphOp(op_name=\"dilation4\").apply(im)\n```\n\nRun it:\n```\n$ python 03_poc.py\nSegmentation fault (core dumped)\n```\n\nObserved on a source build of commit `3e2ab96`.\n\nUnder AddressSanitizer:\n```\n==ERROR: AddressSanitizer: SEGV on unknown address (pc ... in apply)\n    #0 apply   src/_imagingmorph.c:81\nSUMMARY: AddressSanitizer: SEGV src/_imagingmorph.c:81 in apply\n```\nWith width 0 the `outrow[width - 1]` write lands on an unmapped page, so it surfaces as a SEGV pinned to the edge-write line rather than a redzone overflow.\n\n### Impact\nOut-of-bounds write in a C extension. Affects any application that runs a morphology operation on an image opened from untrusted input. Result is a crash and possible memory corruption.\n\n## Affected packages\n\n- `pillow < 13.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `pillow 13.0.0`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 8, … · no fix planned: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112397.json)","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":227049,"id":"CVE-2026-112397","ts":1792585043878,"field":"cvss","old":"8.7","new":"7.5"}]}