Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
At a glance
Severity
HIGH 8.2
EPSS
EPSS 0.59 % · percentile 48 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
GitHub_M
NVD status
Analyzed
Description
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter is never reached. An attacker can supply or cause creation of a zero-size image to an application that applies a rank, median, minimum, or maximum filter. This causes a native process crash. This issue is fixed in version 13.0.0.
GHSA-27h8-gf7j-v5hc — Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
PYSEC-2026-4326 — Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() al
