CVE-2026-112397

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0

Description A flaw exists in the Python imaging library where the ImageMorph.MorphOp.apply() function can access memory before a row buffer when processing images with a width of zero. This occurs because the PPM and PGM parsers do not perform lower-bound checks on the image width, allowing the creation of images with size (0, N). When such an image is processed by the native morphology routine, it attempts to index outrow[width - 1], which results in an out-of-bounds write at outrow[-1]. An attacker can trigger this by supplying a specially crafted PPM or PGM image to an application that performs morphology operations, leading to a process crash or potential memory corruption.

Recommendations Update to version 13.0.0. As a temporary workaround, restrict the use of the ImageMorph.MorphOp.apply() function when processing images from untrusted sources.