Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST resampling. The output image allocation must succeed while the additional per-column lookup allocation fails, after which the error path deletes image storage that later cleanup releases again. An attacker who can drive such a large Image.transform() operation under memory pressure may trigger the failure. This can crash the process and may corrupt memory. This issue is fixed in version 13.0.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when
    ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles
    Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST
    resampling. The output image allocation must succeed while the additional per-column lookup allocation
    fails, after which the error path deletes image storage that later cleanup releases again. An attacker who
    can drive such a large Image.transform() operation under memory pressure may trigger the failure. This can
    crash the process and may corrupt memory. This issue is fixed in version 13.0.0. (CVE-2026-112402)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when     ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles     Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST     resampling. The output image allocation must succeed while the additional per-column lookup allocation     fails, after which the error path deletes image storage that later cleanup releases again. An attacker who     can drive such a large Image.transform() operation under memory pressure may trigger the failure. This can     crash the process and may corrupt memory. This issue is fixed in version 13.0.0. (CVE-2026-112402)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
476590	SCA: security update for Pillow (GHSA-7mwm-ghpf-9vrm)	Tenable Cloud Security	SCA Checks	Local	high
476590	SCA: security update for Pillow (GHSA-7mwm-ghpf-9vrm)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
367556	Linux Distros Unpatched Vulnerability : CVE-2026-112402	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-112402

high

Tenable Plugins

high

high

high