Pillow: Invalid free in FreeType glyph rendering when a stroker is active
影響: pip:pillow >= 10.0.0, < 13.0.0 → 13.0.0
When text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph. If FT_Load_Glyph fails for a glyph, the cleanup path calls FT_Done_Glyph on the glyph variable. That variable is not initialized before the first measurement loop, and in the render loop it is not reset to NULL after each glyph is freed. A malformed font loaded from untrusted bytes can force the load error and reach this free. This is a latent memory-safety defect; whether it cr…
| CVE | CVE-2026-112893 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 22. 오전 05:20 |
| 데이터 | Markdown JSON |
2026. 10. 22. 오전 05:06, GitHub Advisory Database에서 "Pillow: Invalid free in FreeType glyph rendering when a stroker is active"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: Python. CVE: CVE-2026-112893.