CVE-2026-112394

— UNSCOREDpublic exploit available

Published 2026-10-19 · Updated 2026-10-19

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can read past the end of an input buffer. ImagingRawDecode calculates a packed-pixel row size, while the unpackers read separately padded bit planes. A caller can supply a buffer and image dimensions whose accepted size is smaller than the unpacker's actual footprint. This can disclose up to three adjacent heap bytes in output pixels or crash the process. This issue is fixed in version 13.0.0.

Weaknesses

CWE-126

Public exploit & PoC references

https://github.com/python-pillow/Pillow/commit/392ee6f0d19a4adb766a63e9a99f3c28193b8d31
https://github.com/python-pillow/Pillow/releases/tag/13.0.0
https://github.com/python-pillow/Pillow/security/advisories/GHSA-4558-3h8r-v8xp

All references

https://github.com/python-pillow/Pillow/commit/392ee6f0d19a4adb766a63e9a99f3c28193b8d31
https://github.com/python-pillow/Pillow/releases/tag/13.0.0
https://github.com/python-pillow/Pillow/security/advisories/GHSA-4558-3h8r-v8xp

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

LOWCVE-2026-101094
LOWCVE-2026-101130
HIGHCVE-2026-101310
HIGHCVE-2026-102728PoC
HIGHCVE-2026-102758PoC
MEDIUMCVE-2026-103567
MEDIUMCVE-2026-108454
UNSCOREDCVE-2026-112404PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.