Description
Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.
Published: 2026-10-19
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Memory Corruption / Process Crash
Action: Immediate Patch
AI Analysis

Impact

Pillow, a popular Python imaging library, has a flaw in its FreeType glyph rendering when a stroker is active. If FT_Load_Glyph fails, the cleanup code may call FT_Done_Glyph on an uninitialized or stale glyph pointer, which can corrupt memory or crash the process due to improper deallocation (CWE‑457, CWE‑763).

Affected Systems

The vulnerability affects any installation of Pillow between versions 10.0.0 and 12.x inclusive. Applications that use Pillow to render text with a non‑zero stroke width and that accept font data from external sources are vulnerable. This includes many web frameworks, desktop graphic tools, and any custom scripts that process user‑supplied images or typography.

Risk and Exploitability

The CVSS score of 8.2 indicates a high severity. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, suggesting limited evidence of current exploitation. Based on the description, it is inferred that an attacker can trigger the failure by delivering a malformed font file as untrusted bytes to an application that renders text with a stroker, typically via file uploads, web service interfaces, or local file loading. Exploitation requires that the application load the font with a stroker enabled, which is common in graphic libraries that support styled text.

Generated by OpenCVE AI on October 20, 2026 at 06:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Pillow to version 13.0.0 or later, which includes the glyph rendering fix.
  • Audit and update all Python project dependencies to ensure no older Pillow releases are pulled in transitively.
  • Restrict font inputs to trusted sources or validate font data before rendering; alternatively disable stroker usage when processing external fonts.

Generated by OpenCVE AI on October 20, 2026 at 06:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-j4m9-6w36-pw47 Pillow: Invalid free in FreeType glyph rendering when a stroker is active
History

Wed, 28 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 27 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Python
Python pillow
CPEs cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
Vendors & Products Python
Python pillow

Tue, 20 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Tue, 20 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Python-pillow
Python-pillow pillow
Vendors & Products Python-pillow
Python-pillow pillow

Mon, 19 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Description Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.
Title Pillow: Invalid free in FreeType glyph rendering when a stroker is active
Weaknesses CWE-457
CWE-763
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Python Pillow
Python-pillow Pillow
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-28T15:12:48.729Z

Reserved: 2026-10-19T20:16:09.856Z

Link: CVE-2026-112893

cve-icon Vulnrichment

Updated: 2026-10-28T15:12:19.814Z

cve-icon NVD

Status : Modified

Published: 2026-10-19T22:17:09.350

Modified: 2026-10-28T16:17:02.413

Link: CVE-2026-112893

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-19T21:53:49Z

Links: CVE-2026-112893 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T07:00:13Z

Weaknesses
  • CWE-457

    Use of Uninitialized Variable

  • CWE-763

    Release of Invalid Pointer or Reference