CVE-2026-112397: Pillow: Out-of-bounds access in _imagingmorph on a zero-width image

October 20, 2026

A PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size (0, N). Passing that image to ImageMorph.MorphOp.apply() makes the native morphology code index a row buffer at outrow[width - 1], which is outrow[-1] when the width is 0. The process crashes.

References

github.com/advisories/GHSA-58r4-6rv3-gfh8
github.com/python-pillow/Pillow/commit/18f7c0dfee93063c51db6ed0ca8c4da2999dcb64
github.com/python-pillow/Pillow/releases/tag/13.0.0
github.com/python-pillow/Pillow/security/advisories/GHSA-58r4-6rv3-gfh8
nvd.nist.gov/vuln/detail/CVE-2026-112397

Code Behaviors & Features

Detect and mitigate CVE-2026-112397 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →