CVE-2026-112394

A flaw was found in pillow. A remote attacker could trigger an out-of-bounds read by supplying specially crafted image dimensions and input buffers to the raw image decoders. Because the decoder calculates an image row size smaller than the unpacker's actual memory footprint, the library reads past the end of the buffer. This flaw can lead to information disclosure by exposing adjacent heap memory in output pixels or cause a Denial of Service (DoS) by crashing the application.

This vulnerability is rated as Moderate severity because successful exploitation requires an application to directly invoke raw decoding interfaces on untrusted input using specific planar bit modes. Standard file format decoders bundled in Pillow do not trigger this condition during normal image loading operations. Additionally, the potential impact is constrained to process crashes or disclosing at most three neighboring heap bytes, without allowing arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.