Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.
References
| Link | Resource |
|---|---|
| https://github.com/python-pillow/Pillow/commit/a7416de7f3a43128179d2cf68df3240ea8dafe13 | Patch |
| https://github.com/python-pillow/Pillow/releases/tag/13.0.0 | Release Notes |
| https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47 | Exploit Vendor Advisory |
| https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47 | Exploit Vendor Advisory |
Configurations
History
28 Oct 2026, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47 - Exploit, Vendor Advisory |
27 Oct 2026, 14:59
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Python
Python pillow |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | () https://github.com/python-pillow/Pillow/commit/a7416de7f3a43128179d2cf68df3240ea8dafe13 - Patch | |
| References | () https://github.com/python-pillow/Pillow/releases/tag/13.0.0 - Release Notes | |
| References | () https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47 - Exploit, Vendor Advisory | |
| CPE | cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* |
19 Oct 2026, 22:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-19 22:17
Updated : 2026-10-28 16:17
NVD link : CVE-2026-112893
Mitre link : CVE-2026-112893
CVE.ORG link : CVE-2026-112893
JSON object : View
Products Affected
python
- pillow