Summary
[5.1.1-33]
- CVE-2026-112892 python-pillow: pillow: Denial of Service via unbounded
memory expansion in MSP image decoder
Resolves: RHEL-290437
[5.1.1-32]
- CVE-2026-96640 python-pillow: pillow: Denial of Service via duplicate
page references in PDF files
Resolves: RHEL-289281
[5.1.1-31]
- CVE-2026-112406 python-pillow: pillow: Denial of Service via infinite loop
during PDF page rewriting
Resolves: RHEL-287839
[5.1.1-30]
- CVE-2026-112402 python-pillow: pillow: Denial of service via double free
during image transformation
Resolves: RHEL-287157
[5.1.1-29]
- CVE-2026-112894 python-pillow: pillow: Denial of Service via crafted
multi-frame image conversion
Resolves: RHEL-287147
[5.1.1-28]
- CVE-2026-112895 python-pillow: pillow: Denial of service via crafted PDF
during append operations
Resolves: RHEL-287152
[5.1.1-27]
- CVE-2026-112392 python-pillow: pillow: Denial of Service via zero-size
images in rank filters
Resolves: RHEL-287128
[5.1.1-26]
- Security fix for CVE-2026-112397
Resolves: RHEL-287137
[5.1.1-25]
- CVE-2026-112391 python-pillow: Pillow: Denial of Service via unbounded recursion in PDF parser
Resolves: RHEL-287109
[5.1.1-24]
- CVE-2026-112405 python-pillow: Pillow: Denial of Service via null pointer dereference in Image.merge()
Resolves: RHEL-287123
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | python3-pillow | 0:5.1.1-33.el8_10 |
| Oracle Linux · 8 | python3-pillow-devel | 0:5.1.1-33.el8_10 |
| Oracle Linux · 8 | python3-pillow-doc | 0:5.1.1-33.el8_10 |
| Oracle Linux · 8 | python3-pillow-tk | 0:5.1.1-33.el8_10 |
Vulnerabilities 10
-
High 8.7
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[widt…
-
High 8.7
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations…
-
High 8.7
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narr…
-
High 8.7
Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to…
-
High 8.7
Pillow: MSP RLE decoder expands a tiny file into unbounded memory
Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacke…
-
High 8.7
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifi…
-
High 8.7
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer…
-
High 8.2
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from …
-
High 8.2
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", append=True) processes …
-
Medium 6.3
Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append.…