A failed glyph load with a stroker active frees an invalid pointer

Pillow: Invalid free in FreeType glyph rendering when a stroker is active

Advisory

CVE-2026-112893

Library

Pillow, pillow on PyPI

Published

2026-10-21

Severity

not scored upstream

Affected

< 12.3.0

Fixed in

12.3.0

Reaches you

through another call

What triggers it

Drawing stroked text with a malformed font through ImageDraw and ImageFont.

What sillybos does

Refused by default

sillybos refuses the triggering file under its default policy, through the format check.

The carrier is a malformed font loaded through FreeType, drawn with a stroke width so that a failed glyph load reaches the stale pointer. Handed to the check, its first bytes are not one of the four formats a scan can be and it is refused as unknown, so the record claims that refusal, though a font is a program's asset that no image check is usually in front of. Neither Tetrak OCR nor sillybos imports ImageFont or ImageDraw.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Re-bucketed on 2026-11-03: the file that carries the trigger is one the check refuses, so the record claims it.

Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:

• tests/test_check.py::TestHostileFiles::test_a_font_or_archive_is_refused_as_unknown

How to protect yourself

In general. Upgrade to Pillow 12.3.0.

Specifically. Load only fonts you ship, never a font from outside; and if a file from outside could be one, run the check on it: a font is refused as unknown.

The general advice applies to every row here.

Sources

• https://osv.dev/vulnerability/GHSA-j4m9-6w36-pw47
• The record entry, triaged 2026-11-03, last checked 2026-11-03