CVE-2026-112893

Name of the Vulnerable Software and Affected Versions Pillow versions 10.0.0 through 12.9.9

Description During FreeType rendering with an active stroker, the library may free an invalid glyph pointer. This occurs when the FT Load Glyph() function fails, leading the cleanup process to call FT Done Glyph() on a stale or uninitialized glyph variable. An attacker can trigger this failure path by providing a malformed font as untrusted bytes to an application that renders text with a nonzero stroke width, potentially resulting in memory corruption or a process crash.

Recommendations Update to version 13.0.0.