CVE-2026-112893CWE-457CWE-763

CVE-2026-112893

published October 20, 2026

CVSS
8.2
EPSS
0%
Percentile
20.6
In the wild
Unconfirmed
What it is

Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.

The record
Technical detail
CVSS
8.2 · NONE
CVSS v4.0
8.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00291 · 20.6th percentile
Weaknesses
CWE-457 · Use of Uninitialized Variable; CWE-763 · Release of Invalid Pointer or Reference
Published
2026-10-20T02:17Z
References (3)
https://github.com/python-pillow/Pillow/commit/a7416de7f3a43128179d2cf68df3240ea8dafe13 · [email protected]https://github.com/python-pillow/Pillow/releases/tag/13.0.0 · [email protected]https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47 · [email protected]
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 19 OCT 21:53Z
    Pillow: Invalid free in FreeType glyph rendering when a stroker is active
    cvelistv5
  • 19 OCT 21:53Z
    Pillow: Invalid free in FreeType glyph rendering when a stroker is active
    cvelistv5