{"id":"CVE-2026-112405","summary":"Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0","details":"Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC file can reach this path when an application opens and loads it, or a caller can invoke Image.merge() directly with such a first band. This causes a native process crash. This issue is fixed in version 13.0.0.","aliases":["GHSA-cp9v-662q-vvx9"],"modified":"2026-10-21T09:40:04.241661449Z","published":"2026-10-19T21:29:53.515Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112405.json","unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"12.0.0"},{"fixed":"13.0.0"}]}]},{"extracted_events":[{"source":"DESCRIPTION","range":[{"fixed":"13.0.0"}]}]}],"cna_assigner":"GitHub_M","cwe_ids":["CWE-476"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112405.json"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/b6ee66e8b2c2c0932bdf65f963268d9f2927ef86"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-cp9v-662q-vvx9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112405"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/python-pillow/pillow","events":[{"introduced":"0"},{"fixed":"b6ee66e8b2c2c0932bdf65f963268d9f2927ef86"},{"fixed":"293218ad059d994baf1777d882911bed6a49704a"}],"database_specific":{"extracted_events":[{"source":"REFERENCES_COMMIT","range":[{"fixed":"b6ee66e8b2c2c0932bdf65f963268d9f2927ef86"}]},{"source":"REFERENCES_TAG","original_tag":"13.0.0","range":[{"fixed":"293218ad059d994baf1777d882911bed6a49704a"}]}]}}],"versions":["12.3.0","12.2.0","12.1.0","12.0.0","11.3.0","11.2.1","11.1.0","11.0.0","10.4.0","10.3.0","10.2.0","10.1.0","10.0.0","9.5.0","9.4.0","9.3.0","9.2.0","9.1.0","9.0.0","8.4.0","8.3.0","8.2.0","8.1.0","8.0.0","7.2.0","7.1.0","7.0.0","6.2.0","6.1.0","6.0.0","5.4.0","5.3.0","5.2.0","5.1.0","5.0.0","4.3.0","4.2.0","4.1.0","4.0.0","4.0.0a","3.4.0","3.3.0","3.2.0","3.1.0","3.1.0-rc1","2.9.0","2.9.0.dev2","2.9.0.dev1","2.9.0.dev0","2.8.1","2.8.0","2.7.0","2.5.0","2.3.0","2.2.1","2.2.0","2.1.0","2.0.0","1.7.8","1.7.7","1.2","1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112405.json","vanir_signatures":[{"target":{"function":"ImagingMerge","file":"src/libImaging/Bands.c"},"deprecated":false,"digest":{"length":2041,"function_hash":"193459129178121911948828196224834832575"},"id":"CVE-2026-112405-e32d4a67","signature_type":"Function","signature_version":"v1","source":"https://github.com/python-pillow/pillow/commit/b6ee66e8b2c2c0932bdf65f963268d9f2927ef86"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/python-pillow/pillow/commit/b6ee66e8b2c2c0932bdf65f963268d9f2927ef86","target":{"file":"src/libImaging/Bands.c"},"deprecated":false,"digest":{"line_hashes":["250794764123263324197498914438116061245","169091917877980220189679798427483786468","317878413223139980140027752359642102745","96082465364421759874928216317487010857","36359792585899783629032670261589713656","192839002253453241433723353730446181183","48317581898119425030675793569410991375","272611402321680526621265836179300503552","112935392692548227893262439151674231617","121360432752104958315734959606209274569","249399748374427168688481972367994878849","135018300971368061530998862149924570989","319416612265986988400971221204247619345","178491451249301220972997501332343829264","166562583417110962452184047892650187552","281756467319718804905225764719337120728","182046593354383855883375723427694871184","50476628973131086992474947479316544084","290551283469382941448589648393350357944","334717040422619420912784346337270231984"],"threshold":0.9},"id":"CVE-2026-112405-f9c12e6d"}],"vanir_signatures_modified":"2026-10-21T09:40:04Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}