CVE-2026-112394

A flaw was found in pillow. A remote attacker could trigger an out-of-bounds read by supplying specially crafted image dimensions and input buffers to the raw image decoders. Because the decoder calculates an image row size smaller than the unpacker's actual memory footprint, the library reads pa...