CWE data temporarily unavailableCWE data is currently experiencing intermittent outages, which may cause incomplete section loading on CVE pages. We are actively working on a fix.

CVE-2026-112405

Description

A flaw was found in Pillow. A remote attacker can cause a Denial of Service (DoS) by supplying a specially crafted image file to an application that processes images with the library. This issue occurs because the Image.merge() function fails to properly validate the first input band, allowing mismatched image storage formats to trigger a null pointer dereference. Consequently, processing the malformed image causes the native application process to crash.

Statement

This vulnerability is rated as having an Important impact for Red Hat products because an unauthenticated remote attacker can crash service worker processes handling user uploads without requiring privileges or prior interaction. In Red Hat environments such as Ansible Automation Platform, Satellite, and OpenShift AI, Pillow is embedded across containerized services and platform tooling that handle image ingest and transformation. Because parsing an invalid image file triggers an immediate segmentation fault within the native extension, the issue causes service disruption, although it does not compromise data confidentiality or allow arbitrary code execution.

Mitigation

--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to validate all input image bands to reject 4-byte pixel sizes and 32-bit storage modes prior to invoking Image.merge(): upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which validate all input bands and reject any band with a 4-byte pixel size or non-single band configuration with a mode error, closing all 2 injection vectors (crafted IPTC image file parsed during standard open and load operations, direct invocation of Image.merge() with a 32-bit image band). Until patched, this is a concern on applications using Pillow to process untrusted image files or calling Image.merge() on untrusted image bands, so restrict image ingestion pipelines from processing untrusted IPTC files or passing unvalidated 32-bit single-band images into Image.merge(). As a compensating measure, enforce an explicit allowlist of permitted image modes and band configurations before invoking Image.merge() to prevent processing unsupported 32-bit image bands. These controls limit blast radius and contain exploitation, but they do not fix the underlying null pointer dereference defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (medium)

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score7.57.5N/A
Attack VectorNetworkNetworkN/A
Attack ComplexityLowLowN/A
Privileges RequiredNoneNoneN/A
User InteractionNoneNoneN/A
ScopeUnchangedUnchangedN/A
ConfidentialityNoneNoneN/A
Integrity ImpactNoneNoneN/A
Availability ImpactHighHighN/A

Vector

Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.