CVE-2026-112402 - Vulnerability Details

- Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform

Description

Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST resampling. The output image allocation must succeed while the additional per-column lookup allocation fails, after which the error path deletes image storage that later cleanup releases again. An attacker who can drive such a large Image.transform() operation under memory pressure may trigger the failure. This can crash the process and may corrupt memory. This issue is fixed in version 13.0.0.

Published: 2026-10-19

Score: 8.7 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Pillow, a Python imaging library, contains a double‑free bug in the ImagingScaleAffine function. When an Image.transform() operation performs a large transform with the default NEAREST resampling, a secondary memory allocation may fail after a first successful allocation. The error path then frees the image storage twice, corrupting the heap. The result can be a crash or memory corruption, but the CVE description does not indicate any code execution capability.

Affected Systems

Any installation of Pillow prior to version 13.0.0 is affected. Python applications that perform transform operations such as Transform.EXTENT or pure scale‑and‑translate Transform.AFFINE with NEAREST resampling may trigger the flaw. The bug is fixed in Pillow 13.0.0 and later.

Risk and Exploitability

The CVSS base score of 8.7 signals high impact. EPSS is not available, so exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. The attack requires an attacker to be able to influence the size of image data processed by a Python process under memory pressure; successful exploitation results in process termination or heap corruption, potentially creating a denial‑of‑service condition.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

python-pillow

Pillow

affected

Version	Status	Constraints
`< 13.0.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions

Python-pillow

Pillow

100%

Version	Status	Scheme	Platform
`[0,13.0.0)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Pillow to version 13.0.0 or later; this fixes the use‑after‑free flaw identified as CWE‑416.
Implement application‑level validations to restrict image dimensions and prevent allocation failures that could trigger a double‑free (CWE‑1341).
Add graceful handling for allocation failures to avoid attempts to free already released memory and mitigate potential denial‑of‑service conditions.

Generated by OpenCVE AI on October 20, 2026 at 06:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Github GHSA	GHSA-7mwm-ghpf-9vrm	Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00594.

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/python-pillow/Pillow/commit/aafa6c75f7cdabb9f409a8aac7c780bea31d08d9
https://github.com/python-pillow/Pillow/releases/tag/13.0.0
https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm
https://nvd.nist.gov/vuln/detail/CVE-2026-112402
https://www.cve.org/CVERecord?id=CVE-2026-112402

History

Tue, 27 Oct 2026 21:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Python Python pillow
CPEs		cpe:2.3:a:python:pillow::::::::
Vendors & Products		Python Python pillow

Tue, 20 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1341
References		https://nvd.nist.gov/vuln/detail/CVE-2026-112402 https://www.cve.org/CVERecord?id=CVE-2026-112402
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Mon, 19 Oct 2026 23:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Python-pillow Python-pillow pillow
Vendors & Products		Python-pillow Python-pillow pillow

Mon, 19 Oct 2026 22:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 19 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Description		Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST resampling. The output image allocation must succeed while the additional per-column lookup allocation fails, after which the error path deletes image storage that later cleanup releases again. An attacker who can drive such a large Image.transform() operation under memory pressure may trigger the failure. This can crash the process and may corrupt memory. This issue is fixed in version 13.0.0.
Title		Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
Weaknesses		CWE-416
References		https://github.com/python-pillow/Pillow/commit/aafa6c75f7cdabb9f409a8aac7c780bea31d08d9 https://github.com/python-pillow/Pillow/releases/tag/13.0.0 https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Python Pillow

Python-pillow Pillow

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-10-19T21:18:57.027Z

Updated: 2026-10-19T21:37:35.120Z

Reserved: 2026-10-19T16:58:51.959Z

Link: CVE-2026-112402

Vulnrichment

Updated: 2026-10-19T21:37:30.919Z

NVD

Status : Analyzed

Published: 2026-10-19T22:17:07.633

Modified: 2026-10-27T21:03:13.880

Link: CVE-2026-112402

Redhat

Severity : Important

Publid Date: 2026-10-19T21:18:57Z

Links: CVE-2026-112402 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T07:00:13Z

Weaknesses

CWE-1341
Multiple Releases of Same Resource or Handle
CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation poc

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object