Tetrak
GitHub ↗
Security · Pillow

Image.transform frees twice when an oversized transform runs out of memory

Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform

Advisory
CVE-2026-112402
Library
Pillow, pillow on PyPI
Published
Severity
not scored upstream
Affected
< 12.3.0
Fixed in
12.3.0
Reaches you
through another call

What triggers it

Image.transform with an output size too large to allocate.

What sillybos does

Not reached by opening a file

Opening or reading a file never reaches this flaw, so a check before decoding has nothing to refuse. Listed so that nobody expects it to.

The trigger is the output size the program passes to Image.transform, and it has to be absurd: a one-row output hundreds of millions of pixels wide, so that the small per-column table is the allocation that fails while the image still fits, on a worker with an address-space limit. No file carries it. What the check bounds is any size a program derives from the file: with max_side at 30,000 the table is 120 KB and never fails, and a PDF page is bounded at render_dpi. Tetrak OCR never calls transform; its turns go through transpose, as does Pillow's EXIF handling, and its resizes are to sizes computed from the image. Pillow's rotate reaches transform only for angles that are not right angles, and the upstream report says rotate is not affected.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Re-read on 2026-11-03: what the file contributes, and what the check bounds.

How to protect yourself

In general. Upgrade to Pillow 12.3.0.

Specifically. Derive transform sizes from the image's size, which the check bounds, and clip any size that comes from outside; upgrade to Pillow 12.3.0.

The general advice applies to every row here.

Sources