CVE-2026-112402

The Pillow Python imaging library contains a double-free vulnerability in the ImagingScaleAffine component. When performing Image.transform() operations (specifically Transform.EXTENT or pure scale-and-translate Transform.AFFINE with NEAREST resampling) under memory pressure, a selective allocati...

CVE-2026-112402 Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform

Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST resampling...