Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST resampling. The output image allocation must succeed while the additional per-column lookup allocation fails, after which the error path deletes image storage that later cleanup releases again. An attacker who can drive such a large Image.transform() operation under memory pressure may trigger the failure. This can crash the process and may corrupt memory. This issue is fixed in version 13.0.0.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/python-pillow/Pillow/commit/aafa6c75f7cdabb9f409a8aac7c780bea31d08d9 Patch
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm Exploit, Mitigation, Patch, Vendor Advisory
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm Exploit, Mitigation, Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 5
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-27 21:03
- StatusUndergoing Analysis → AnalyzedNVD modified 2026-10-27 21:03
- StatusPublished → Undergoing AnalysisNVD modified 2026-10-20 19:48
- StatusReceived → PublishedNVD modified 2026-10-19 21:37
- First seenCVSS 8.7NVD modified 2026-10-19 22:17
Affected (CPE criteria) 1
cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
References 4
- https://github.com/python-pillow/Pillow/commit/aafa6c75f7cdabb9f409a8aac7c780bea31d08d9 Patch
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0 Release Notes
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm Exploit, Mitigation, Patch, Vendor Advisory
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm Exploit, Mitigation, Patch, Vendor Advisory