Vulnerability details

CVE-2026-112893

python-pillow Pillow

Pillow: Invalid free in FreeType glyph rendering when a stroker is active

CVSS 4.0

8.2High

Official description

Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.

CVSS scores

Score	Version	Source	Vector
8.2High	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`

Affected products

Vendor	Product	Versions	Source
python-pillow	Pillow	>= 10.0.0, < 13.0.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/python-pillow/Pillow/commit/a7416de7f3a43128179d2cf68df3240ea8dafe13 x_refsource_MISC
https://github.com/python-pillow/Pillow/releases/tag/13.0.0 x_refsource_MISC
https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47 x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-20
Last updated: 2026-10-28
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.54%

Probability of exploitation in 30 days

46.1%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-457
Use of Uninitialized Variable
CWE-763
Release of Invalid Pointer or Reference