Pillow: Invalid free in FreeType glyph rendering when a stroker is active
影響: pip:pillow >= 10.0.0, < 13.0.0 → 13.0.0
When text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph. If FT_Load_Glyph fails for a glyph, the cleanup path calls FT_Done_Glyph on the glyph variable. That variable is not initialized before the first measurement loop, and in the render loop it is not reset to NULL after each glyph is freed. A malformed font loaded from untrusted bytes can force the load error and reach this free. This is a latent memory-safety defect; whether it cr…
Read on GitHub Advisory Database
| CVE | CVE-2026-112893 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/22/2026, 05:20 AM |
| Data | Markdown JSON |
On 10/22/2026, 05:06 AM, GitHub Advisory Database published "Pillow: Invalid free in FreeType glyph rendering when a stroker is active" (type: Advisory). Severity is "High" (high). Related technologies: Python. CVE: CVE-2026-112893.