Bug 2555878 (CVE-2026-112893) - CVE-2026-112893 pillow: Pillow: Denial of Service via invalid pointer free during font rendering
Summary: CVE-2026-112893 pillow: Pillow: Denial of Service via invalid pointer free du...
Keywords:
Status: NEW
Alias: CVE-2026-112893
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-19 22:01 UTC by OSIDB Bzimport
Modified: 2026-10-20 21:01 UTC (History)
59 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-19 22:01:39 UTC 
Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.
Note You need to log in before you can comment on or make changes to this bug.