CVE-2026-112405 | Pillow up to 12.x IPTC file Image.merge null pointer dereference

October 20, 2026 Yanac

A vulnerability has been found in Pillow up to 12.x and classified as problematic. Affected by this vulnerability is the function Image.merge of the component IPTC file Handler. Performing a manipulation results in null pointer dereference.

This vulnerability is known as CVE-2026-112405. Remote exploitation of the attack is possible. No exploit is available.

The affected component should be upgraded.VulDB Recent EntriesRead More