CVE-2026-112394

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-112394
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112394.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-112394
Aliases
Downstream
Published
2026-10-19T20:48:28Z
Modified
2026-10-21T09:40:05Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
Details

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can read past the end of an input buffer. ImagingRawDecode calculates a packed-pixel row size, while the unpackers read separately padded bit planes. A caller can supply a buffer and image dimensions whose accepted size is smaller than the unpacker's actual footprint. This can disclose up to three adjacent heap bytes in output pixels or crash the process. This issue is fixed in version 13.0.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-126"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112394.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "13.0.0"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StringRangeExpression"
                }
            ]
        },
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "13.0.0"
                        },
                        {
                            "fixed":  "13.0.0"
                        }
                    ],
                    "source":  "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/python-pillow/pillow

Affected ranges

Type
GIT
Repo
https://github.com/python-pillow/pillow
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
392ee6f0d19a4adb766a63e9a99f3c28193b8d31
Fixed
293218ad059d994baf1777d882911bed6a49704a
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "fixed":  "392ee6f0d19a4adb766a63e9a99f3c28193b8d31"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "13.0.0",
            "range":  [
                {
                    "fixed":  "293218ad059d994baf1777d882911bed6a49704a"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*
1.0
1.2
1.7.7
1.7.8
10.*
10.0.0
10.1.0
10.2.0
10.3.0
10.4.0
11.*
11.0.0
11.1.0
11.2.1
11.3.0
12.*
12.0.0
12.1.0
12.2.0
12.3.0
2.*
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.5.0
2.7.0
2.8.0
2.8.1
2.9.0
2.9.0.dev0
2.9.0.dev1
2.9.0.dev2
3.*
3.1.0
3.1.0-rc1
3.2.0
3.3.0
3.4.0
4.*
4.0.0
4.0.0a
4.1.0
4.2.0
4.3.0
5.*
5.0.0
5.1.0
5.2.0
5.3.0
5.4.0
6.*
6.0.0
6.1.0
6.2.0
7.*
7.0.0
7.1.0
7.2.0
8.*
8.0.0
8.1.0
8.2.0
8.3.0
8.4.0
9.*
9.0.0
9.1.0
9.2.0
9.3.0
9.4.0
9.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112394.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "248881631502931839687656035826811270737",
            "length":  1454
        },
        "id":  "CVE-2026-112394-0bb54e12",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/python-pillow/pillow/commit/392ee6f0d19a4adb766a63e9a99f3c28193b8d31",
        "target":  {
            "file":  "src/_imaging.c",
            "function":  "_putpalette_impl"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "327655869027868441759663480264551295563",
                "230780021245841265451655966920902735306",
                "92689861405719245366882810048016921281",
                "83288793991364379674938562955182900495"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-112394-22326f04",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/python-pillow/pillow/commit/392ee6f0d19a4adb766a63e9a99f3c28193b8d31",
        "target":  {
            "file":  "src/libImaging/RawDecode.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "65541343807383946999807672400994792896",
            "length":  341
        },
        "id":  "CVE-2026-112394-2a641411",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/python-pillow/pillow/commit/392ee6f0d19a4adb766a63e9a99f3c28193b8d31",
        "target":  {
            "file":  "src/decode.c",
            "function":  "get_unpacker"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "279811297567193129707958925329158272798",
                "133441461419431026873300080493564425241",
                "203264981017951256094914249453827588462",
                "234104527076764120955404328612016298163"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-112394-62392b10",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/python-pillow/pillow/commit/392ee6f0d19a4adb766a63e9a99f3c28193b8d31",
        "target":  {
            "file":  "src/libImaging/Imaging.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "37861010007568475748375045525208130556",
            "length":  1123
        },
        "id":  "CVE-2026-112394-623f783c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/python-pillow/pillow/commit/392ee6f0d19a4adb766a63e9a99f3c28193b8d31",
        "target":  {
            "file":  "src/libImaging/RawDecode.c",
            "function":  "ImagingRawDecode"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "71587089013452263954036118708758268029",
                "317661913984550154395031586723166142541",
                "330715926276212718074883644941808702951",
                "249874162581883650963756954386613498424",
                "77776210196735306358490025663668085508",
                "48262229417609153862164701053689316162",
                "168036742174312871359522440572183648841",
                "867966520924350295936806543378277087",
                "315641461504055091159143222469339002420",
                "240835791501681704666529725427859151236"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-112394-879a01dc",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/python-pillow/pillow/commit/392ee6f0d19a4adb766a63e9a99f3c28193b8d31",
        "target":  {
            "file":  "src/decode.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "245196157538215618410038501172435223362",
            "length":  1669
        },
        "id":  "CVE-2026-112394-c2f16656",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/python-pillow/pillow/commit/392ee6f0d19a4adb766a63e9a99f3c28193b8d31",
        "target":  {
            "file":  "src/decode.c",
            "function":  "_setimage"
        }
    }
]
vanir_signatures_modified 
"2026-10-21T09:40:05Z"