{"schema_version":"1.7.2","id":"OESA-2026-4739","modified":"2026-11-11T12:25:42Z","published":"2026-11-11T12:25:42Z","upstream":["CVE-2026-112893","CVE-2026-96638"],"summary":"python-pillow security update","details":"Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \\ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift.    of CVE-2022-22815,CVE-2022-22816)\r\n\r\nSecurity Fix(es):\n\nPillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.(CVE-2026-112893)\n\nPillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining dest_length without a per-branch cap. A delta can add roughly 255 image rows in one iteration, so a kilobyte-sized file with a large but permitted width can expand the data bytearray to hundreds of megabytes or more, causing memory-exhaustion denial of service. This issue is fixed in version 13.0.0.(CVE-2026-96638)","affected":[{"package":{"ecosystem":"openEuler:24.03-LTS-SP1","name":"python-pillow","purl":"pkg:rpm/openEuler/python-pillow&distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3.0-15.oe2403sp1"}]}],"ecosystem_specific":{"aarch64":["python-pillow-debuginfo-10.3.0-15.oe2403sp1.aarch64.rpm","python-pillow-debugsource-10.3.0-15.oe2403sp1.aarch64.rpm","python3-pillow-10.3.0-15.oe2403sp1.aarch64.rpm","python3-pillow-devel-10.3.0-15.oe2403sp1.aarch64.rpm","python3-pillow-qt-10.3.0-15.oe2403sp1.aarch64.rpm","python3-pillow-tk-10.3.0-15.oe2403sp1.aarch64.rpm"],"noarch":["python3-pillow-help-10.3.0-15.oe2403sp1.noarch.rpm"],"src":["python-pillow-10.3.0-15.oe2403sp1.src.rpm"],"x86_64":["python-pillow-debuginfo-10.3.0-15.oe2403sp1.x86_64.rpm","python-pillow-debugsource-10.3.0-15.oe2403sp1.x86_64.rpm","python3-pillow-10.3.0-15.oe2403sp1.x86_64.rpm","python3-pillow-devel-10.3.0-15.oe2403sp1.x86_64.rpm","python3-pillow-qt-10.3.0-15.oe2403sp1.x86_64.rpm","python3-pillow-tk-10.3.0-15.oe2403sp1.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4739"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112893"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96638"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"database_specific":{"severity":"High"}}