Skip to content
OpenAdvisories
High ALSA-2026:92639 10 CVEs

Important: python-pillow security update

Published Oct 29, 2026 · Updated Oct 30, 2026

Ecosystem: AlmaLinux

Summary

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* pillow: Pillow: Denial of Service via unbounded recursion in PDF parser (CVE-2026-112391)
* pillow: pillow: Denial of service via double free during image transformation (CVE-2026-112402)
* pillow: pillow: Denial of Service via zero-size images in rank filters (CVE-2026-112392)
* pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images (CVE-2026-112397)
* pillow: Pillow: Denial of Service via null pointer dereference in Image.merge() (CVE-2026-112405)
* pillow: pillow: Denial of Service via crafted multi-frame image conversion (CVE-2026-112894)
* pillow: pillow: Denial of service via crafted PDF during append operations (CVE-2026-112895)
* pillow: pillow: Denial of Service via infinite loop during PDF page rewriting (CVE-2026-112406)
* pillow: pillow: Denial of Service via duplicate page references in PDF files (CVE-2026-96640)
* pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder (CVE-2026-112892)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 4

ReleasePackageFixed in
AlmaLinux · 8 python3-pillow 5.1.1-33.el8_10
AlmaLinux · 8 python3-pillow-devel 5.1.1-33.el8_10
AlmaLinux · 8 python3-pillow-doc 5.1.1-33.el8_10
AlmaLinux · 8 python3-pillow-tk 5.1.1-33.el8_10

Vulnerabilities 10

  • High 8.7
    CVE-2026-112397

    Pillow: Out-of-bounds access in _imagingmorph on a zero-width image

    Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[widt…

    python-pillow Pillow open-webui kserve-storage-controller Debian Ubuntu Wolfi PyPI
  • High 8.7
    CVE-2026-112402

    Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform

    Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 8.7
    CVE-2026-112405

    Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0

    Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narr…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 8.7
    CVE-2026-112406

    Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 8.7
    CVE-2026-112892

    Pillow: MSP RLE decoder expands a tiny file into unbounded memory

    Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacke…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 8.7
    CVE-2026-112894

    Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)

    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifi…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 8.7
    CVE-2026-112895

    Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)

    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer…

    python-pillow Pillow open-webui kserve-storage-controller Debian Ubuntu Wolfi PyPI
  • High 8.2
    CVE-2026-112392

    Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

    Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from …

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 8.2
    CVE-2026-96640

    Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", append=True) processes …

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • Medium 6.3
    CVE-2026-112391

    Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()

    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append.…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-112391
  • report
    https://access.redhat.com/security/cve/CVE-2026-112392
  • report
    https://access.redhat.com/security/cve/CVE-2026-112397
  • report
    https://access.redhat.com/security/cve/CVE-2026-112402
  • report
    https://access.redhat.com/security/cve/CVE-2026-112405
  • report
    https://access.redhat.com/security/cve/CVE-2026-112406
  • report
    https://access.redhat.com/security/cve/CVE-2026-112892
  • report
    https://access.redhat.com/security/cve/CVE-2026-112894
  • report
    https://access.redhat.com/security/cve/CVE-2026-112895
  • report
    https://access.redhat.com/security/cve/CVE-2026-96640
  • report
    https://bugzilla.redhat.com/2555851
  • report
    https://bugzilla.redhat.com/2555859
  • report
    https://bugzilla.redhat.com/2555866
  • report
    https://bugzilla.redhat.com/2555868
  • report
    https://bugzilla.redhat.com/2555873
  • report
    https://bugzilla.redhat.com/2555875
  • report
    https://bugzilla.redhat.com/2555879
  • report
    https://bugzilla.redhat.com/2556322
  • report
    https://bugzilla.redhat.com/2558576
  • report
    https://bugzilla.redhat.com/2559393
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-92639.html