CVE-2026-112893

— UNSCOREDpublic exploit available

Published 2026-10-19 · Updated 2026-10-19

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.

Weaknesses

CWE-457, CWE-763

Public exploit & PoC references

https://github.com/python-pillow/Pillow/commit/a7416de7f3a43128179d2cf68df3240ea8dafe13
https://github.com/python-pillow/Pillow/releases/tag/13.0.0
https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47

All references

https://github.com/python-pillow/Pillow/commit/a7416de7f3a43128179d2cf68df3240ea8dafe13
https://github.com/python-pillow/Pillow/releases/tag/13.0.0
https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-100759
MEDIUMCVE-2026-100783
MEDIUMCVE-2026-100799
MEDIUMCVE-2026-100802
MEDIUMCVE-2026-100806
HIGHCVE-2026-100813
HIGHCVE-2026-102717PoC
LOWCVE-2026-103436PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.