SecBoard
Zurück zur CVE-Übersicht

CVE-2026-112392

HIGH(7.5)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Risk Signal Score19/100 — NIEDRIG
  • CVSS 7.5 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.6%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.5

Technische Schwere

Beschreibung

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter is never reached. An attacker can supply or cause creation of a zero-size image to an application that applies a rank, median, minimum, or maximum filter. This causes a native process crash. This issue is fixed in version 13.0.0.

Betroffene Produkte

  • cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*

GitHub Advisories

GHSA-27h8-gf7j-v5hcHIGH

Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

pip/Pillow→ 13.0.0
GitHub Advisory

Referenzen