Pillow: Out-of-bounds access in _imagingmorph on a zero-width image

影響: pip:Pillow <= 12.3.0 → 13.0.0

A PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size (0, N). Passing that image to ImageMorph.MorphOp.apply() makes the native morphology code index a row buffer at outrow[width - 1], which is outrow[-1] when the width is 0. The process crashes. Details The PPM parser reads width and height with no lower-bound check: - src/PIL/PpmImagePlugin.py:119 The native apply() writes the row edges with no guard that the width is positive: - src/_imagingmorp…

GitHub Advisory Database에서 읽기

2026. 10. 21. 오전 05:56, GitHub Advisory Database에서 "Pillow: Out-of-bounds access in _imagingmorph on a zero-width image"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: Python. CVE: CVE-2026-112397.