Description
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter is never reached. An attacker can supply or cause creation of a zero-size image to an application that applies a rank, median, minimum, or maximum filter. This causes a native process crash. This issue is fixed in version 13.0.0.
Published: 2026-10-19
Score: 8.2 High
EPSS: n/a
KEV: No
Impact: Denial of Service (native process crash)
Action: Patch
AI Analysis

Impact

Pillow’s rank‑based filters can trigger a null pointer dereference when processing a zero‑size image. The flaw occurs in ImagingExpand() before ImagingRankFilter is applied, causing the native image processing code to crash. The vulnerability is classified as an invalid null reference (CWE‑476) and does not provide code execution or data disclosure.

Affected Systems

The problem exists in all Python Pillow versions earlier than 13.0.0. Any Python application that imports Pillow and applies a rank, median, minimum or maximum filter to an image that is zero‑bytes in size is vulnerable.

Risk and Exploitability

The CVSS score is 8.2, indicating a high severity. EPSS data is not available and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker can trigger the flaw by providing or causing the creation of a zero‑size image that is then processed by a rank filter; the exploitation path is straightforward.

Generated by OpenCVE AI on October 20, 2026 at 00:43 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Pillow to version 13.0.0 or later.
  • Validate that images are non‑zero size before invoking any rank‑based filter.
  • If an upgrade is delayed, implement a pre‑check that rejects or safely handles empty images to prevent the crash.

Generated by OpenCVE AI on October 20, 2026 at 00:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Mon, 19 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter is never reached. An attacker can supply or cause creation of a zero-size image to an application that applies a rank, median, minimum, or maximum filter. This causes a native process crash. This issue is fixed in version 13.0.0.
Title Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
Weaknesses CWE-476
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-19T21:17:18.908Z

Reserved: 2026-10-19T16:58:51.959Z

Link: CVE-2026-112392

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T22:17:06.587

Modified: 2026-10-19T22:17:06.587

Link: CVE-2026-112392

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-19T21:17:18Z

Links: CVE-2026-112392 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T00:45:06Z

Weaknesses