BREW-AIDER-CVE-2026-112397 (GHSA-58R4-6RV3-GFH8)
Vulnerability from osv_homebrew – Published: 2026-10-21 09:14 – Updated: 2026-10-21 09:14 – Source websiteSummary
A PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size (0, N). Passing that image to ImageMorph.MorphOp.apply() makes the native morphology code index a row buffer at outrow[width - 1], which is outrow[-1] when the width is 0. The process crashes.
Details
The PPM parser reads width and height with no lower-bound check:
src/PIL/PpmImagePlugin.py:119
The native apply() writes the row edges with no guard that the width is positive:
src/_imagingmorph.c:81setsoutrow[0] = outrow[width - 1] = 0;
match() and get_on_pixels() use the same edge-indexing pattern.
PoC
from PIL import Image, ImageMorph
# A width-0 image (also producible from a crafted PPM header). apply() indexes
# outrow[width - 1] == outrow[-1] in native code.
im = Image.new("L", (0, 5))
ImageMorph.MorphOp(op_name="dilation4").apply(im)
Run it:
$ python 03_poc.py
Segmentation fault (core dumped)
Observed on a source build of commit 3e2ab96.
Under AddressSanitizer:
==ERROR: AddressSanitizer: SEGV on unknown address (pc ... in apply)
#0 apply src/_imagingmorph.c:81
SUMMARY: AddressSanitizer: SEGV src/_imagingmorph.c:81 in apply
With width 0 the outrow[width - 1] write lands on an unmapped page, so it surfaces as a SEGV pinned to the edge-write line rather than a redzone overflow.
Impact
Out-of-bounds write in a C extension. Affects any application that runs a morphology operation on an image opened from untrusted input. Result is a crash and possible memory corruption.
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "pillow",
"resource_purl": "pkg:pypi/pillow@12.1.1",
"upstream_fixed_in": "13.0.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "aider",
"purl": "pkg:brew/aider"
},
"ranges": [
{
"events": [
{
"introduced": "0.86.1_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/pillow@12.1.1",
"name": "pillow",
"resource": "pillow",
"strategy": "registry",
"subject_version": "12.1.1"
}
]
},
"details": "### Summary\nA PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size `(0, N)`. Passing that image to `ImageMorph.MorphOp.apply()` makes the native morphology code index a row buffer at `outrow[width - 1]`, which is `outrow[-1]` when the width is 0. The process crashes.\n\n### Details\nThe PPM parser reads width and height with no lower-bound check:\n\n- `src/PIL/PpmImagePlugin.py:119`\n\nThe native `apply()` writes the row edges with no guard that the width is positive:\n\n- `src/_imagingmorph.c:81` sets `outrow[0] = outrow[width - 1] = 0;`\n\n`match()` and `get_on_pixels()` use the same edge-indexing pattern.\n\n### PoC\n```python\nfrom PIL import Image, ImageMorph\n\n# A width-0 image (also producible from a crafted PPM header). apply() indexes\n# outrow[width - 1] == outrow[-1] in native code.\nim = Image.new(\"L\", (0, 5))\nImageMorph.MorphOp(op_name=\"dilation4\").apply(im)\n```\n\nRun it:\n```\n$ python 03_poc.py\nSegmentation fault (core dumped)\n```\n\nObserved on a source build of commit `3e2ab96`.\n\nUnder AddressSanitizer:\n```\n==ERROR: AddressSanitizer: SEGV on unknown address (pc ... in apply)\n #0 apply src/_imagingmorph.c:81\nSUMMARY: AddressSanitizer: SEGV src/_imagingmorph.c:81 in apply\n```\nWith width 0 the `outrow[width - 1]` write lands on an unmapped page, so it surfaces as a SEGV pinned to the edge-write line rather than a redzone overflow.\n\n### Impact\nOut-of-bounds write in a C extension. Affects any application that runs a morphology operation on an image opened from untrusted input. Result is a crash and possible memory corruption.",
"id": "BREW-aider-CVE-2026-112397",
"modified": "2026-10-21T09:14:41Z",
"published": "2026-10-21T09:14:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-58r4-6rv3-gfh8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112397"
},
{
"type": "WEB",
"url": "https://github.com/python-pillow/Pillow/commit/18f7c0dfee93063c51db6ed0ca8c4da2999dcb64"
},
{
"type": "PACKAGE",
"url": "https://github.com/python-pillow/Pillow"
},
{
"type": "WEB",
"url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Pillow: Out-of-bounds access in _imagingmorph on a zero-width image",
"upstream": [
"GHSA-58r4-6rv3-gfh8",
"CVE-2026-112397"
]
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.