CVE-2026-112405 - Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
CVE ID :CVE-2026-112405 Published : Oct. 19, 2026, 10:17 p.m. | 1 hour, 48 minutes ago Description :Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or...