Skip to content
OpenAdvisories
High RHSA-2026:92639 10 CVEs

Red Hat Security Advisory: python-pillow security update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 14

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream python-pillow 0:5.1.1-33.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream python-pillow-debuginfo 0:5.1.1-33.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream python-pillow-debugsource 0:5.1.1-33.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream python3-pillow 0:5.1.1-33.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream python3-pillow-debuginfo 0:5.1.1-33.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream python3-pillow-tk-debuginfo 0:5.1.1-33.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb python-pillow-debuginfo 0:5.1.1-33.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb python-pillow-debugsource 0:5.1.1-33.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb python3-pillow 0:5.1.1-33.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb python3-pillow-debuginfo 0:5.1.1-33.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb python3-pillow-devel 0:5.1.1-33.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb python3-pillow-doc 0:5.1.1-33.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb python3-pillow-tk 0:5.1.1-33.el8_10
Red Hat · RHEL 8 enterprise_linux:8::crb python3-pillow-tk-debuginfo 0:5.1.1-33.el8_10

Vulnerabilities 10

  • High 8.7
    CVE-2026-112397

    Pillow: Out-of-bounds access in _imagingmorph on a zero-width image

    Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[widt…

    python-pillow Pillow open-webui kserve-storage-controller Debian Ubuntu Wolfi PyPI
  • High 8.7
    CVE-2026-112402

    Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform

    Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 8.7
    CVE-2026-112405

    Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0

    Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narr…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 8.7
    CVE-2026-112406

    Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 8.7
    CVE-2026-112892

    Pillow: MSP RLE decoder expands a tiny file into unbounded memory

    Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacke…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 8.7
    CVE-2026-112894

    Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)

    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifi…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 8.7
    CVE-2026-112895

    Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)

    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer…

    python-pillow Pillow open-webui kserve-storage-controller Debian Ubuntu Wolfi PyPI
  • High 8.2
    CVE-2026-112392

    Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

    Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from …

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 8.2
    CVE-2026-96640

    Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", append=True) processes …

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • Medium 6.3
    CVE-2026-112391

    Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()

    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append.…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2555851
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2555859
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2555866
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2555868
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2555873
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2555875
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2555879
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2556322
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2558576
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2559393
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_92639.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-96640
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-96640
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-96640
  • article
    https://github.com/python-pillow/Pillow/commit/6f0e7ee1f9c2fe227906f8a4b926e6622b702bc7
  • article
    https://github.com/python-pillow/Pillow/pull/10093
  • article
    https://github.com/python-pillow/Pillow/releases/tag/13.0.0
  • article
    https://github.com/python-pillow/Pillow/security/advisories/GHSA-mrfp-p49p-3hf2
  • report
    https://access.redhat.com/security/cve/CVE-2026-112391
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-112391
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-112391
  • article
    https://github.com/python-pillow/Pillow/commit/94cb11c44ff7345414da17ebfea1598a529ad9cd
  • article
    https://github.com/python-pillow/Pillow/security/advisories/GHSA-254f-3936-288h
  • report
    https://access.redhat.com/security/cve/CVE-2026-112392
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-112392
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-112392
  • article
    https://github.com/python-pillow/Pillow/commit/443e3130a8c11594fd0e296afad497e11e678961
  • article
    https://github.com/python-pillow/Pillow/security/advisories/GHSA-27h8-gf7j-v5hc
  • report
    https://access.redhat.com/security/cve/CVE-2026-112397
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-112397
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-112397
  • article
    https://github.com/python-pillow/Pillow/commit/18f7c0dfee93063c51db6ed0ca8c4da2999dcb64
  • article
    https://github.com/python-pillow/Pillow/security/advisories/GHSA-58r4-6rv3-gfh8
  • report
    https://access.redhat.com/security/cve/CVE-2026-112402
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-112402
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-112402
  • article
    https://github.com/python-pillow/Pillow/commit/aafa6c75f7cdabb9f409a8aac7c780bea31d08d9
  • article
    https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm