CVE-2026-112405: Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0

October 21, 2026

Image.merge() checks the mode of every input band except band 0. If band 0 is a single-band I or F image, the native merge routine reads a pixel pointer that is NULL for those modes and the process crashes. The IPTC plugin reaches this from a plain Image.open() followed by a load, and IPTC has no magic-byte prefilter, so a crafted file with no recognizable header can drive it.

References

github.com/advisories/GHSA-cp9v-662q-vvx9
github.com/python-pillow/Pillow/commit/b6ee66e8b2c2c0932bdf65f963268d9f2927ef86
github.com/python-pillow/Pillow/releases/tag/13.0.0
github.com/python-pillow/Pillow/security/advisories/GHSA-cp9v-662q-vvx9
nvd.nist.gov/vuln/detail/CVE-2026-112405

Code Behaviors & Features

Detect and mitigate CVE-2026-112405 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →