CVE-2026-112392 Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter i...

CVE-2026-112392

The Pillow Python imaging library contains a NULL pointer dereference vulnerability in its rank-based filters, affecting versions prior to 13.0.0 . The issue occurs when ImagingExpand() is called on a zero-size image ; the function allocates a non-empty output but fails while attempting to replic...

image-size 资源管理错误漏洞

image-size is a lightweight image size retrieval tool developed by image-size. Versions of image-size from 1.1.0 to 1.2.1 and from 2.0.0 to 2.0.2 contained security vulnerabilities. These vulnerabilities stemmed from the findBox function, which had a denial-of-service vulnerability when processin...