How does a crafted IPTC image crash Python applications using Pillow?

The short version

• Pillow versions before 13.0.0 contain a high-severity vulnerability
• The flaw stems from insufficient validation in the Image.merge function
• Attacker-controlled IPTC data can trigger a NULL pointer dereference

The details

The advisory GHSA-cp9v-662q-vvx9 describes a flaw in the Pillow imaging library. Versions 12.0.0 and later, up to but excluding 13.0.0, are vulnerable to CVE-2026-112405. The issue arises within the Image.merge method, which fails to validate the mode of the first input band. When this band is a single-band integer or floating-point image, the underlying C extension attempts to read a pixel pointer that is null. This results in a segmentation fault rather than a catchable Python exception.

The IPTC image plugin provides the path for exploitation. It registers an opener without a magic-byte prefilter, allowing crafted files with no recognizable header to be processed. The plugin builds a band list from attacker-typed sub-images and passes them to the merge routine. Because the validation loop skips the first band, the native merge code dereferences the missing plane, crashing the process.

The context

GitHub rates this severity as high. The vulnerability exists in the core imaging logic and the IPTC plugin. A proof-of-concept demonstrates that creating a single-band image and merging it with others triggers the crash. The crash occurs in the C extension, specifically in the Bands.c file. This means applications relying on Pillow to process untrusted images face immediate availability risks.

Next steps

• Upgrade Pillow to version 13.0.0 immediately
• Audit applications that process IPTC files
• Monitor for segmentation faults in image processing services
• Review input validation for all image libraries

What defenders should look for

Teams usually detect this activity through sudden worker process crashes. Check logs for segmentation faults occurring shortly after image ingestion. Look for spikes in service restarts when processing user-uploaded media. Verify that error handling does not catch these low-level crashes. Ensure monitoring alerts trigger on abnormal termination codes. Isolate affected services to prevent cascading failures. Review access logs to identify the source of malicious files. Validate that upstream systems reject malformed image headers before processing.

Background: Input validation

Input validation works by comparing incoming data against a strict model of allowed values, types and lengths. It rejects anything that deviates from this model before processing. This prevents malformed data from triggering logic errors or executing unintended commands within the application.

Read the full guide: Input Validation Mechanics: How Parsing Blocks Attacks

What to do and how to stay safe: Pillow

• Update Pillow to version 13.0.0 or later
• Scan for untrusted IPTC files in processing queues
• Implement strict input validation for image uploads
• Monitor application logs for unexpected crashes

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Pillow versions are vulnerable to CVE-2026-112405?

Versions 12.0.0 and later, up to but excluding 13.0.0, are vulnerable.

Is there a patch available for this vulnerability?

Yes, the issue is fixed in Pillow version 13.0.0.

How does the vulnerability get triggered?

It is triggered by opening and loading a crafted IPTC file through the Image.merge function.