Skip to content
OpenAdvisories
High · 8.7 CVE-2026-112405 BIT-pillow-2026-112405EUVD-2026-104646GHSA-cp9v-662q-vvx9PYSEC-2026-4333

Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0

Published Oct 19, 2026 · Updated Oct 20, 2026 · Assigned by GitHub_M

Vendor: python-pillow Product: Pillow Package: open-webui Package: pillow Package: pillow Package: pillow Package: pillow-python2 Package: py3.10-pillow Package: py3.11-pillow Package: py3.12-pillow Package: py3.13-pillow Ecosystem: Debian Ecosystem: PyPI Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC file can reach this path when an application opens and loads it, or a caller can invoke Image.merge() directly with such a first band. This causes a native process crash. This issue is fixed in version 13.0.0.

Affected products

VendorProductAffectedFixed
python-pillow Pillow >= 12.0.0, < 13.0.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 pillow No fix yet —
Debian 12 pillow No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 pillow 12.3.0-1ubuntu2 USN-9064-1
Ubuntu 26.04 LTS pillow 12.1.1-2ubuntu1.5 USN-9064-1
Ubuntu 24.04 LTS pillow 10.2.0-1ubuntu1.5 USN-9064-1
Ubuntu 22.04 LTS pillow 9.0.1-1ubuntu0.7 USN-9064-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS pillow 7.0.0-4ubuntu0.9+esm2 USN-9064-1
Ubuntu Pro 20.04 LTS pillow-python2 No fix yet —
Ubuntu Pro 18.04 LTS pillow 5.1.0-1ubuntu0.8+esm3 USN-9064-1
Ubuntu Pro 16.04 LTS pillow 3.1.2-0ubuntu1.6+esm4 USN-9064-1
Ubuntu Pro 14.04 LTS pillow 2.3.0-1ubuntu3.4+esm6 USN-9064-1

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 python3-pillow +3 5.1.1-33.el8_10 ALSA-2026:92639

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 python-pillow 5.1.1-33.el8_10 RLSA-2026:92639

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 python-Pillow 7.2.0-150300.3.33.1 SUSE-SU-2026:5038-1
SLES 15 SP6 python-Pillow 9.5.0-150400.5.28.1 SUSE-SU-2026:5194-1
SLES 15 SP5 python-Pillow 9.5.0-150400.5.28.1 SUSE-SU-2026:5194-1
SLES 15 SP4 python-Pillow 9.5.0-150400.5.28.1 SUSE-SU-2026:5194-1
SLES 3 python-Pillow 9.5.0-150400.5.28.1 SUSE-SU-2026:5194-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 python-Pillow 11.3.0-160000.9.1 SUSE-SU-2026:24656-1
SLES for SAP 15 SP6 python-Pillow 9.5.0-150400.5.28.1 SUSE-SU-2026:5194-1
SLES for SAP 15 SP5 python-Pillow 9.5.0-150400.5.28.1 SUSE-SU-2026:5194-1
SLES for SAP 15 SP4 python-Pillow 9.5.0-150400.5.28.1 SUSE-SU-2026:5194-1
SLES 16.0 python-Pillow 11.3.0-160000.9.1 SUSE-SU-2026:24656-1
SLE HPC 15 SP5 python-Pillow 9.5.0-150400.5.28.1 SUSE-SU-2026:5194-1
SLE HPC 15 SP4 python-Pillow 9.5.0-150400.5.28.1 SUSE-SU-2026:5194-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 python-Pillow 11.3.0-160000.9.1 openSUSE-SU-2026:22246-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 python3-pillow +3 5.1.1-33.el8_10 ELSA-2026-92639

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling open-webui 0.12.3-r6 —
Wolfi rolling py3.10-pillow No fix yet —
Wolfi rolling py3.11-pillow +2 13.0.0-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI pillow >= 12.0.0, < 13.0.0 13.0.0 GHSA-cp9v-662q-vvx9

Advisories 9

References