Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter is never reached. An attacker can supply or cause creation of a zero-size image to an application that applies a rank, median, minimum, or maximum filter. This causes a native process crash. This issue is fixed in version 13.0.0.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/python-pillow/Pillow/commit/443e3130a8c11594fd0e296afad497e11e678961 Patch
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-27h8-gf7j-v5hc Exploit, Patch, Vendor Advisory
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-27h8-gf7j-v5hc Exploit, Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 8
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-26 20:52
- StatusPublished → AnalyzedNVD modified 2026-10-26 20:52
- StatusUndergoing Analysis → PublishedNVD modified 2026-10-20 14:50
- StatusPublished → Undergoing AnalysisNVD modified 2026-10-20 19:50
- StatusReceived → PublishedNVD modified 2026-10-20 14:50
- StatusPublished → ReceivedNVD modified 2026-10-20 15:17
- StatusReceived → PublishedNVD modified 2026-10-19 21:17
- First seenCVSS 8.2NVD modified 2026-10-19 22:17
Affected (CPE criteria) 1
cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
References 4
- https://github.com/python-pillow/Pillow/commit/443e3130a8c11594fd0e296afad497e11e678961 Patch
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0 Release Notes
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-27h8-gf7j-v5hc Exploit, Patch, Vendor Advisory
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-27h8-gf7j-v5hc Exploit, Patch, Vendor Advisory