CVE-2026-112405

Name of the Vulnerable Software and Affected Versions Pillow versions 12.0.0 through 12.x

Description The Image.merge() function can dereference a null image8 plane because validation skips the first input band. This allows a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A native process crash can be triggered if a caller invokes Image.merge() directly with such a first band or if an application opens and loads a crafted IPTC file.

Recommendations Update to version 13.0.0.