{"id":"ghsa-ghsa-58r4-6rv3-gfh8","seq":2379,"kind":"advisory","title":"Pillow: Out-of-bounds access in _imagingmorph on a zero-width image","url":"https://github.com/advisories/GHSA-58r4-6rv3-gfh8","permalink":"https://vulnpulse.app/items/ghsa-ghsa-58r4-6rv3-gfh8","summary":"影響: pip:Pillow <= 12.3.0 → 13.0.0\nSummary A PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size (0, N). Passing that image to ImageMorph.MorphOp.apply() makes the native morphology code index a row buffer at outrow[width - 1], which is outrow[-1] when the width is 0. The process crashes. Details The PPM parser reads width and height with no lower-bound check: - src/PIL/PpmImagePlugin.py:119 The native apply() writes the row edges with no guard that the width is positive: - src/_imagingmorp…","severity":"high","techs":["python"],"cves":["CVE-2026-112397"],"tags":["GHSA-58r4-6rv3-gfh8","Pillow"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T20:56:22.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}