Listen to this Post
CVE-2026-112397 is an out-of-bounds write vulnerability affecting the Python Imaging Library (Pillow) prior to version 13.0.0. The vulnerability arises because the PPM and PGM image parsers accept a width of zero without performing lower-bound validation checks. When a zero-width image is successfully loaded and subsequently passed into native morphology methods such as ImageMorph.MorphOp.apply(), the underlying C extension routine attempts to initialize and manipulate row buffers using indexing calculations like outrow[width - 1]. Because the width is zero, this expression evaluates to outrow[-1], leading directly to a memory write operation prior to the start of the allocated buffer. When exploited via untrusted image inputs supplied by an attacker, this out-of-bounds memory access triggers an immediate segmentation fault, resulting in a process crash and potential memory corruption. Developers using Pillow to handle external or untrusted image files are susceptible to this denial-of-service vector unless they upgrade to the patched version.
DailyCVE Form:
Platform: Python Pillow
Version: < 13.0.0
Vulnerability : Out-of-bounds Write
Severity: Critical
date: October 17, 2026
Prediction: Already Patched
What Undercode Say:
Bash Commands:
python 03_poc.py
Code Snippet:
from PIL import Image, ImageMorph
im = Image.new("L", (0, 5))
ImageMorph.MorphOp(op_name="dilation4").apply(im)
Exploit: (Educational Purposes!)
An attacker crafts a malicious PPM or PGM file containing a declaration where the image width is set to zero. Because the parser fails to validate or reject zero or negative dimensions, Pillow creates an image geometry of size (0, N). When this invalid image object is handed over to the native morphology operator ImageMorph.MorphOp.apply(), the C extension indexes the row buffer at outrow[width - 1]. For a zero width, this resolves to outrow[-1], causing an out-of-bounds write that writes to unmapped memory pages or corrupts adjacent heap data, thereby crashing the target application process.
Protection: from this CVE
Upgrade the Python Pillow library to version 13.0.0 or later where lower-bound validation checks are enforced on image dimensions and native morphology indexing is properly guarded. Additionally, implement robust input validation filters to reject malformed or zero-dimension image files before passing them into image processing pipelines.
Impact:
Successful exploitation of this vulnerability allows an unauthenticated attacker to trigger an out-of-bounds memory write in a C extension. This causes an immediate application crash (Denial of Service) and introduces potential risks of memory corruption when processing untrusted image data.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
