CVE-2026-112394: Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
On main, even with the guard in #9725, it’s possible to have these decoders read 1 to 3 bytes past the end of the passed buffer with a suitable width/height.
References
- github.com/advisories/GHSA-4558-3h8r-v8xp
- github.com/python-pillow/Pillow/commit/392ee6f0d19a4adb766a63e9a99f3c28193b8d31
- github.com/python-pillow/Pillow/pull/9723
- github.com/python-pillow/Pillow/releases/tag/13.0.0
- github.com/python-pillow/Pillow/security/advisories/GHSA-4558-3h8r-v8xp
- nvd.nist.gov/vuln/detail/CVE-2026-112394
Code Behaviors & Features
Detect and mitigate CVE-2026-112394 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →