Detections
Analytics

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : Pillow vulnerabilities (USN-9064-1)

critical Nessus Plugin ID 381338

Synopsis

The remote Ubuntu host is missing one or more security updates.

Description

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-9064-1 advisory.

 It was discovered that Pillow could enter an infinite loop while determining the frame count of a MIC image. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-112390)

 It was discovered that Pillow's PdfParser.get_value() could recurse without a limit while reading nested PDF objects. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS. (CVE-2026-112391)

 It was discovered that Pillow's rank-based filters could dereference invalid image storage for a zero-size image. An attacker could possibly use this issue to cause a crash. (CVE-2026-112392)

 It was discovered that Pillow had a heap buffer overflow in _tiffWriteProc when saving compressed TIFF data. An attacker could possibly use this issue to crash the process or execute arbitrary code.
 (CVE-2026-112393)

 It was discovered that Pillow's P;2L and P;4L raw decoders could read past the end of an input buffer. An attacker could possibly use this issue to disclose heap memory or crash the process. (CVE-2026-112394)

 It was discovered that Pillow's tiled-TIFF decoder could read past the tile buffer while copying four-byte pixels. An attacker could possibly use this issue to expose heap data or crash the process. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-112395)

 It was discovered that Pillow had a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. An attacker could possibly use this issue to crash the process or execute arbitrary code. This issue only affected Ubuntu 26.10 and Ubuntu 26.04 LTS. (CVE-2026-112396)

 It was discovered that Pillow's ImageMorph.MorphOp.apply() could access memory before a row buffer for a zero-width image. An attacker could possibly use this issue to cause a crash. (CVE-2026-112397)

 It was discovered that Pillow's FlashPix JPEG-tile decoder could write decoded scanlines beyond the allocated tile buffer. An attacker could possibly use this issue to corrupt heap memory and execute arbitrary code. (CVE-2026-112398)

 It was discovered that Pillow could allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. An attacker could possibly use this issue to exhaust memory and cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-112399)

 It was discovered that Pillow could retain a rejected GIF frame size after a decompression-bomb exception.
 An attacker could possibly use this issue to exhaust memory and cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-112400)

 It was discovered that Pillow performed quadratic copying while parsing GIF comments. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-112401)

 It was discovered that Pillow could double free image memory when ImagingScaleAffine encounters a selective allocation failure. An attacker could possibly use this issue to crash the process.
 (CVE-2026-112402)

 It was discovered that Pillow's JPEG decoder could write a full-width scanline into a buffer sized for a requested draft scale. An attacker could possibly use this issue to corrupt heap memory or execute arbitrary code. (CVE-2026-112403)

 It was discovered that Pillow's TIFF tile and RGBA decode paths could read beyond row data produced by libtiff. An attacker could possibly use this issue to expose heap data or crash the process. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-112404)

 It was discovered that Pillow's Image.merge() could dereference a null image8 plane. An attacker could possibly use this issue to cause a crash. This issue only affected Ubuntu 26.10 and Ubuntu 26.04 LTS.
 (CVE-2026-112405)

 It was discovered that Pillow could enter an infinite loop while rewriting PDF pages. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS. (CVE-2026-112406)

 It was discovered that Pillow performed quadratic copying when saving a GIF with a long comment. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-112891)

 It was discovered that Pillow's MSP RLE decoder could expand a small file into an unbounded in-memory buffer. An attacker could possibly use this issue to exhaust memory and cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS. (CVE-2026-112892)

 It was discovered that Pillow could free an invalid glyph pointer during FreeType rendering with an active stroker. An attacker could possibly use this issue to corrupt memory or crash the process. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-112893)

 It was discovered that Pillow took quadratic time to reserve PDF object identifiers when saving many frames. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS. (CVE-2026-112894)

 It was discovered that Pillow could exhaust resources while parsing an existing PDF during an append operation. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS. (CVE-2026-112895)

 It was discovered that Pillow's TIFF encoder could read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. An attacker could possibly use this issue to disclose heap memory or crash the process. (CVE-2026-112896)

 It was discovered that Pillow could return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. An attacker could possibly use this issue to disclose stale heap contents. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-112897)

 It was discovered that Pillow could disclose uninitialized stack memory when Image.quantize() uses an empty palette. An attacker could possibly use this issue to obtain stack contents. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-112898)

 It was discovered that Pillow was vulnerable to argument injection when invoking Ghostscript for EPS input. An attacker could possibly use this issue to inject Ghostscript arguments and execute arbitrary commands. (CVE-2026-112900)

 It was discovered that Pillow's XBM header parser was vulnerable to regular-expression denial of service.
 An attacker could possibly use this issue to cause a denial of service. (CVE-2026-112901)

 It was discovered that Pillow could export non-contiguous image data to Arrow arrays. An attacker could possibly use this issue to disclose uninitialized memory or stale heap contents. This issue only affected Ubuntu 26.10 and Ubuntu 26.04 LTS. (CVE-2026-114501)

 It was discovered that Pillow could overflow an integer when tracking glyph positions for very long strings. An attacker could possibly use this issue to cause logic errors or resource consumption. This issue only affected Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 14.04 LTS. (CVE-2026-42308)

 It was discovered that Pillow could hang indefinitely when processing a malicious PDF with a trailer loop.
 An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS. (CVE-2026-42310)

 It was discovered that Pillow did not properly apply decompression bomb checks after seeking to new frames in MPO, DCX, and MIC images. An attacker could possibly use this issue to bypass the check and cause memory exhaustion. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. (CVE-2026-96636)

 It was discovered that Pillow did not properly apply decompression bomb checks after seeking to new frames in SPIDER images. An attacker could possibly use this issue to cause memory exhaustion. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. (CVE-2026-96637)

 It was discovered that Pillow's BMP RLE decoder could expand a small file into an unbounded in-memory buffer. An attacker could possibly use this issue to exhaust memory and cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-96638)

 It was discovered that Pillow's multi-frame loaders could retain a stale ImagingCore allocation. An attacker could possibly use this issue to cause out-of-bounds writes and crashes. This issue only affected Ubuntu 26.10 and Ubuntu 26.04 LTS. (CVE-2026-96639)

 It was discovered that Pillow did not properly detect cyclic page tree references in PDF parsing. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS.
 (CVE-2026-96640)

 It was discovered that Pillow's PILfont text-width accumulation could overflow due to unchecked negative glyph advances. An attacker could possibly use this issue to cause logic errors or resource consumption.
 (CVE-2026-96641)

 It was discovered that Pillow's TarIO initializer accepted a negative octal member size. An attacker could possibly use this issue to cause an infinite loop and denial of service. (CVE-2026-96642)

 It was discovered that Pillow's Exif.load() could perform quadratic CPU work when processing repeated EXIF headers. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10 and Ubuntu 26.04 LTS. (CVE-2026-96643)

 It was discovered that Pillow could call jpeg_write_marker() for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. An attacker could possibly use this issue to cause a heap buffer overflow and execute arbitrary code. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-96778)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://ubuntu.com/security/notices/USN-9064-1

Plugin Details

Severity: Critical

ID: 381338

File Name: ubuntu_USN-9064-1.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 11/14/2026

Updated: 11/14/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.12

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-96778

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2026-112900

CVSS v4

Risk Factor: Critical

Base Score: 9.2

Threat Score: 8.2

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-112900

Vulnerability Information

CPE: cpe:/o:canonical:ubuntu_linux:14.04:-:lts, cpe:/o:canonical:ubuntu_linux:16.04:-:lts, cpe:/o:canonical:ubuntu_linux:18.04:-:lts, cpe:/o:canonical:ubuntu_linux:20.04:-:lts, cpe:/o:canonical:ubuntu_linux:22.04:-:lts, cpe:/o:canonical:ubuntu_linux:24.04:-:lts, cpe:/o:canonical:ubuntu_linux:26.04:-:lts, cpe:/o:canonical:ubuntu_linux:26.10, p-cpe:/a:canonical:ubuntu_linux:python-imaging-compat, p-cpe:/a:canonical:ubuntu_linux:python-imaging-sane, p-cpe:/a:canonical:ubuntu_linux:python-imaging-tk, p-cpe:/a:canonical:ubuntu_linux:python-imaging, p-cpe:/a:canonical:ubuntu_linux:python-pil.imagetk, p-cpe:/a:canonical:ubuntu_linux:python-pil, p-cpe:/a:canonical:ubuntu_linux:python-sane, p-cpe:/a:canonical:ubuntu_linux:python3-imaging-sane, p-cpe:/a:canonical:ubuntu_linux:python3-imaging-tk, p-cpe:/a:canonical:ubuntu_linux:python3-imaging, p-cpe:/a:canonical:ubuntu_linux:python3-pil.imagetk, p-cpe:/a:canonical:ubuntu_linux:python3-pil, p-cpe:/a:canonical:ubuntu_linux:python3-sane

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/12/2026

Vulnerability Publication Date: 5/4/2026

Reference Information

CVE: CVE-2026-112390, CVE-2026-112391, CVE-2026-112392, CVE-2026-112393, CVE-2026-112394, CVE-2026-112395, CVE-2026-112396, CVE-2026-112397, CVE-2026-112398, CVE-2026-112399, CVE-2026-112400, CVE-2026-112401, CVE-2026-112402, CVE-2026-112403, CVE-2026-112404, CVE-2026-112405, CVE-2026-112406, CVE-2026-112891, CVE-2026-112892, CVE-2026-112893, CVE-2026-112894, CVE-2026-112895, CVE-2026-112896, CVE-2026-112897, CVE-2026-112898, CVE-2026-112900, CVE-2026-112901, CVE-2026-114501, CVE-2026-42308, CVE-2026-42310, CVE-2026-96636, CVE-2026-96637, CVE-2026-96638, CVE-2026-96639, CVE-2026-96640, CVE-2026-96641, CVE-2026-96642, CVE-2026-96643, CVE-2026-96778

USN: 9064-1