CVE-2026-112406

Pillow prior to 13.0.0 is vulnerable to regular-expression denial of service in its XBM header parser. Calling Image.open() on a small crafted XBM file causes a backtracking expression to be applied to the attacker-controlled header, stalling a worker for minutes.

Pillow from 9.1.0 until 13.0.0 can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as output pixel indices in a returned PNG or GIF.

In Pillow from 5.3.0 until 13.0.0, the library can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the bytes written by libtiff, and Pillow does not clear the unwritten tail. An attacker can supply a crafted TIFF to an application that loads and returns or re-encodes its pixels.

In Pillow prior to 13.0.0, the TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read.

In Pillow from 5.1.0 until 13.0.0, the library can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact repeated-offset guard, so deep or cyclic page trees and long chains of unique trailer offsets can exhaust the Python stack. An attacker can supply such a PDF to an application that calls Image.save with PDF append enabled.

In Pillow from 5.1.0 until 13.0.0, reserving PDF object identifiers when saving many frames with save_all enabled takes quadratic time. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF.

In Pillow from 10.0.0 until 13.0.0, the library can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width.

In Pillow from 4.1.0 until 13.0.0, the MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels.

Pillow from 9.2.0 until 13.0.0 performs quadratic copying when saving a GIF with a long comment. _get_global_header() repeatedly copies portions of comment data, including comments from an untrusted input image, which can consume excessive CPU.

In Pillow from 12.0.0 until 13.0.0, Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC file can reach this path when an application opens and loads it, or a caller can invoke Image.merge() directly with such a first band.