CVE-2026-112394: 
Python vulnerability analysis and mitigation

CVE-2026-112394 is a buffer over-read vulnerability in Pillow, the Python imaging library, affecting all versions prior to 13.0.0. The flaw resides in the P;2L and P;4L raw decoders, which can read 1 to 3 bytes past the end of a supplied input buffer due to a size calculation mismatch. It was disclosed on October 17–19, 2026, with a fix released in Pillow 13.0.0. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause (CWE-126: Buffer Over-read) is a disagreement between ImagingRawDecode and the P;2L/P;4L unpackers about how many bytes constitute a line of image data. ImagingRawDecode calculates the row size as (xsize * bits + 7) / 8 (packed-pixel), while unpackP2L and unpackP4L treat data as separately padded bit planes, each of size (pixels + 7) / 8, giving a real footprint of planes * ((xsize + 7) / 8). For certain image widths (e.g., width=1), the decoder accepts a buffer that is too small for the unpacker's actual read footprint, causing reads of 1 byte (P;2L) or up to 3 bytes (P;4L) beyond the buffer boundary. The vulnerability is triggered via Image.frombytes() or Image.frombuffer() calls with crafted width/height values and a P;2L or P;4L rawmode argument. A proof-of-concept reproducer is included in the security advisory and can be confirmed with AddressSanitizer (GitHub Advisory, Fix Commit).

Successful exploitation allows an unauthenticated attacker who can supply a maliciously crafted image to an application using Pillow to disclose up to 3 adjacent heap bytes, which may leak sensitive in-memory data, or crash the host process (denial of service). The impact is limited to applications that directly call Image.frombytes() or Image.frombuffer() with the P;2L or P;4L rawmode; the internal PCX decoder is not affected because it re-packs PCX rows before passing them to these unpackers. There is no integrity impact and no lateral movement potential beyond the process boundary (GitHub Advisory).

No public proof-of-concept exploit code has been released beyond the minimal reproducer included in the security advisory itself, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires that an attacker be able to supply a crafted image buffer to a specific Pillow API call (Image.frombytes() or Image.frombuffer() with planar rawmodes), which limits the practical attack surface (GitHub Advisory, Feedly).

1. Identify target: Find an application that uses Pillow and exposes an image-processing endpoint where user-supplied data is passed to Image.frombytes() or Image.frombuffer() with a P;2L or P;4L rawmode.
2. Craft malicious input: Construct a buffer and image dimensions where the accepted buffer size is smaller than the unpacker's actual footprint. For example, for a 1×4 image with P;2L, supply only 4 bytes (array('B', [0]*4)) — the decoder accepts this but the unpacker reads 1 byte past the end.
3. Submit crafted image: Deliver the crafted buffer to the target application via its image-processing interface (e.g., file upload, API call).
4. Observe output: Inspect the returned pixel values of the last decoded row(s); up to 1 bit per affected plane per pixel from adjacent heap memory is mixed into the output, potentially leaking heap contents. Alternatively, if the read reaches unmapped memory, the process crashes (GitHub Advisory).

The fix is available in Pillow 13.0.0, which corrects the row-size calculation in ImagingRawDecode and decode.c to use planes * ((xsize + 7) / 8) for P;2L and P;4L rawmodes, ensuring the decoder and unpackers agree on buffer size. Upgrade to Pillow 13.0.0 or later via pip install --upgrade Pillow. If immediate patching is not possible, restrict image processing to trusted sources only and validate image dimensions and buffer sizes before passing them to Image.frombytes() or Image.frombuffer() with planar rawmodes (Fix Commit, Pillow 13.0.0 Release).

The vulnerability was reported by researcher akx and acknowledged by the Pillow maintainers, who coordinated a fix through GitHub's private security advisory process. The fix was merged as PR #10186 and included in the Pillow 13.0.0 release. No significant broader media coverage or notable community controversy has been observed beyond the standard advisory publication (GitHub Advisory, Pillow 13.0.0 Release).