Summary
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
Image.merge() checks the mode of every input band except band 0. If band 0 is a single-band I or F image, the native merge routine reads a pixel pointer that is NULL for those modes and the process crashes. The IPTC plugin reaches this from a plain Image.open() followed by a load, and IPTC has no magic-byte prefilter, so a crafted file with no recognizable header can drive it.
Details
The validation loop skips band 0:
src/PIL/Image.py:3795iteratesfor band in bands[1:]and checks mode and size only for those.
For an I or F image the 8-bit plane image8 is NULL (only image32 is set). ImagingMerge dereferences bands[0]->image8[y] for the multi-band output modes:
src/libImaging/Bands.c:302,:311,:321
The IPTC loader builds the band list from an attacker-typed sub-image and passes it to merge with the sub-image at index 0:
src/PIL/IptcImagePlugin.py:156-160src/PIL/IptcImagePlugin.py:169registers the opener with no accept function.
PoC
from PIL import Image
# Band 0 is a single-band "I" image: its image8 plane is NULL. merge() validates only
# bands[1:], so the native ImagingMerge dereferences the NULL plane for band 0.
band0 = Image.new("I", (4, 4))
Image.merge("RGB", [band0, Image.new("L", (4, 4)), Image.new("L", (4, 4))])
Run it:
$ python 02_poc.py
Segmentation fault (core dumped)
Observed on a source build of commit 3e2ab96.
Under AddressSanitizer:
==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
#0 ImagingMerge src/libImaging/Bands.c:311
#1 _merge src/_imaging.c:2492
SUMMARY: AddressSanitizer: SEGV src/libImaging/Bands.c:311 in ImagingMerge
The null address confirms the dereference of the missing image8 plane for band 0.
Impact
NULL pointer dereference in a C extension. A crafted file opened and loaded through the IPTC path crashes the worker process. This is a hard crash, not a Python exception an application can catch.
The application dereferences a null pointer, causing a crash. Typical impact: denial of service via crash.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-112405? CVE-2026-112405 is a high-severity null pointer dereference vulnerability in pillow (pip), affecting versions >= 12.0.0, < 13.0.0. It is fixed in 13.0.0. The application dereferences a null pointer, causing a crash.
- Which versions of pillow are affected by CVE-2026-112405? pillow (pip) versions >= 12.0.0, < 13.0.0 is affected.
- Is there a fix for CVE-2026-112405? Yes. CVE-2026-112405 is fixed in 13.0.0. Upgrade to this version or later.
- Is CVE-2026-112405 exploitable, and should I be worried? Whether CVE-2026-112405 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-112405 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-112405? Upgrade
pillowto 13.0.0 or later.