Pillow Heap Buffer Overflow DoS

The vulnerability in the ImagingExpand and ImagingRankFilter functions within the Pillow image processing library is related to pointer dereferencing errors. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

BIT-PILLOW-2026-112392 Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter i...

PT-2026-123464

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter i...

GHSA-27H8-GF7J-V5HC Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

============================================================================ NULL dereference in ImagingExpand via rank filters on zero-size images Location: src/libImaging/Filter.c:79 in ImagingExpand Commit: a707c6b21c313880d0771e54965d142dd42358b6...

Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

============================================================================ NULL dereference in ImagingExpand via rank filters on zero-size images Location: src/libImaging/Filter.c:79 in ImagingExpand Commit: a707c6b21c313880d0771e54965d142dd42358b6...

EUVD-2026-104639

Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via ImagingExpand in src/libImaging/Filter.c when processing a zero-dimension image through RankFilter or related filters. An attacker can supply an image with a width or height of zero, triggering undefined...

PYSEC-2026-4326

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter i...

PYSEC-2026-4326

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter i...

CVE-2026-112392

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter i...

CVE-2026-112392 Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter i...

CVE-2026-112392

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter i...

CVE-2026-112392 Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter i...

CVE-2026-112392 Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter i...

CVE-2026-112392

The Pillow Python imaging library contains a NULL pointer dereference vulnerability in its rank-based filters, affecting versions prior to 13.0.0 . The issue occurs when ImagingExpand() is called on a zero-size image ; the function allocates a non-empty output but fails while attempting to replic...

Red Hat: CVE-2026-112392: pillow: pillow: Denial of Service via zero-size images in rank filters

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter i...

PT-2026-117653

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description Rank-based filters in the Pillow Python imaging library can dereference invalid image storage when processing a zero-size image. The ImagingExpand function allocates a non-empty output but faults...

Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

Summary Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size. Minimal public API trigger: python from PIL import Image, ImageFilter im = Image.new"L", 3, 3, 128 im.filterImageFilter.MedianFilter4294967295 ImageFilter.RankFilter.filt...

CVE-2026-59197 Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter calls image.expandsize // 2, size // 2 before rank-filter size validation and...

CVE-2026-59197

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter calls image.expandsize // 2, size // 2 before rank-filter size validation and...