VulnerabilityAnalyzed

CVE-2026-112893

An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path.

HIGH 8.2EPSS 0.39%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.39%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.

CVSS 4.0: 8.2 HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.39% probability · 32th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-457, CWE-763
Affected: python/pillow
Source: security-advisories@github.com

EPSS trend

EPSS moved from 0.3% on 20 October 2026 to 0.4% on 26 October 2026.

References

https://github.com/python-pillow/Pillow/commit/a7416de7f3a43128179d2cf68df3240ea8dafe13Patch
https://github.com/python-pillow/Pillow/releases/tag/13.0.0Release Notes
https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47Exploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.