The vulnerability is a NULL pointer dereference that occurs when Pillow's Image.merge processes a first input band that is not validated, allowing a 32‑bit integer or floating‑point image backed by image32 storage to be merged as a narrower multiband image. This leads to a native process crash when a crafted IPTC file is loaded or when Image.merge is invoked directly with such data. The crash represents a denial‑of‑service condition affecting the application process.

Python‑Pillow Pillow versions 12.0.0 up to but not including 13.0.0 are affected. Any application that uses this library between those releases without updating is vulnerable.

The CVSS score of 8.7 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting it is not a widely exploited critical flaw yet. An attacker can trigger the crash by crafting an IPTC file that contains the problematic first band or by calling Image.merge directly with malicious data, causing the target application to terminate. Because this is a crash and not a remote code execution, the risk is limited to disrupting availability rather than compromising confidentiality or integrity. The likely attack vector is local or remote file ingestion by a Python application that trusts image sources.