Pillow: Invalid free in FreeType glyph rendering when a stroker is active

影響: pip:pillow >= 10.0.0, < 13.0.0 → 13.0.0

When text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph. If FT_Load_Glyph fails for a glyph, the cleanup path calls FT_Done_Glyph on the glyph variable. That variable is not initialized before the first measurement loop, and in the render loop it is not reset to NULL after each glyph is freed. A malformed font loaded from untrusted bytes can force the load error and reach this free. This is a latent memory-safety defect; whether it cr…

GitHub Advisory Databaseで読む

2026/10/22 05:06、GitHub Advisory Databaseが「Pillow: Invalid free in FreeType glyph rendering when a stroker is active」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: Python。CVE: CVE-2026-112893。