Pillow 13.0.0 Patch Fixes High-Severity Crash in Python Imaging Library

The Python Imaging Library, Pillow, has released version 13.0.0 to address a high-severity vulnerability. This update resolves a crash condition triggered by zero-size images when specific filters are applied.

What happened

The National Vulnerability Database records CVE-2026-112392 as a high-severity issue with a CVSS score of 8.2. The flaw stems from CWE-476, which involves the use of the null pointer. In Pillow versions prior to 13.0.0, rank-based filters can dereference invalid image storage when processing a zero-size image. The ImagingExpand function allocates a non-empty output buffer but faults while attempting to replicate edges. This occurs because the code tries to read the first pixel from empty input storage. The ImagingRankFilter function is never reached in this specific failure path.

An attacker can supply or cause the creation of a zero-size image to an application. The application must apply a rank, median, minimum, or maximum filter for the flaw to trigger. This action causes a native process crash within the affected software. The issue is confirmed fixed in version 13.0.0 of the Pillow library.

Why it matters

This vulnerability impacts any Python application using Pillow for image processing. The crash occurs in the native process, which can lead to service disruption. Applications that accept user-uploaded images or process external image data are at risk. If a malicious actor can force the creation of a zero-size image, they can trigger the crash. The flaw affects common filter operations such as median and minimum filters.

The NVD rates the severity as high due to the ease of triggering the crash. A successful exploit does not require complex conditions beyond supplying the specific image type. Systems running Pillow versions older than 13.0.0 are vulnerable. The fix is available in the latest release.

What to watch

• Monitor for new CVEs related to Python image processing libraries.
• Check application logs for unexpected native process crashes.
• Verify that all Pillow installations are at version 13.0.0 or higher.

Who needs to act first

Teams should prioritize updating systems that expose image processing functions to external users. Start by identifying applications that accept user-uploaded images or process data from untrusted sources. Test the update in a non-production environment first to ensure compatibility with existing workflows. Back up current configurations and dependencies before applying the patch. If immediate updates are not feasible, consider restricting input validation to reject zero-size images. Review access controls to limit who can trigger image filters.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Pillow

• Verify current Pillow versions across all development and production environments.
• Upgrade to version 13.0.0 once the vendor provides an update.
• Implement input validation to reject zero-size images in applications.
• Monitor system logs for signs of native process crashes.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Pillow are affected by CVE-2026-112392?

All versions of Pillow prior to 13.0.0 are affected by this vulnerability.

What is the severity of this vulnerability?

The NVD rates CVE-2026-112392 as high severity with a CVSS score of 8.2.

How can an attacker exploit this flaw?

An attacker can supply or cause the creation of a zero-size image to trigger a crash.