Pillow EUVD-2026-104646

Exploitation requires either (a) an application using Pillow 12.0.0 up to (but not including) 13.0.0 to open and load an attacker-supplied crafted IPTC file, or (b) a caller invoking Image.merge() directly with a first band that is a 32-bit integer ('I') or floating-point ('F') image backed by image32 storage merged as a narrower multiband image - the validation flaw skips the first input band, allowing the null image8 plane dereference. Limiting factors: only the 12.0.0-12.x release line is affected (13.0.0 is fixed); the vulnerable code path is only reached when the application actually processes attacker-controlled image input, so services that do not accept untrusted images are not realistically exposed; and the outcome is limited to a process crash, not data exposure or code execution.

This is a denial-of-service vulnerability (CWE-476 null pointer dereference) with a genuinely high availability impact but zero confidentiality or integrity impact, which the vendor's own CVSS 4.0 vector reflects (VC:N/VI:N/VA:H). The 8.7 CVSS 4.0 score looks alarming but is driven almost entirely by the network attack vector, low complexity, and no-auth/no-UI metrics combined with a HIGH availability impact - it is a crash, not code execution. No EPSS score was provided, there is no CISA KEV listing in the input (so no confirmed active exploitation), and no public exploit code was supplied; the GitHub commit contains only a regression test, not a weaponized POC. The practical risk is therefore 'crash the worker process' rather than system compromise, which matters most for always-on services that auto-ingest untrusted images (web upload pipelines, thumbnailers) where repeated crashes degrade availability. Note a nuance to verify: the description says exploitation occurs 'when an application opens and loads' a crafted IPTC file, implying the target must process attacker-supplied input, yet the vendor rated UI:N - this is consistent only if you treat automated server-side image processing as requiring no human interaction. Overall this is a real-but-bounded priority: patch promptly on internet-facing image-processing services, lower urgency where images are not attacker-controlled.

An attacker uploads a crafted IPTC-tagged image to a web service that uses a vulnerable Pillow (12.0.0 up to 13.0.0) to open and load it; when Pillow internally reaches Image.merge() with a 32-bit integer or floating-point first band backed by image32 storage, it dereferences a null image8 plane and the native process crashes. No authentication or user interaction beyond submitting the file is required, and attack complexity is low. No public exploit code was identified in the provided data, though the fix commit includes a regression test demonstrating the trigger condition.