Python-Pillow Security Update — AlmaLinux 8 (ALSA-2026:92639)

ALSA-2026:92639 updates Python-Pillow (the Python imaging library) on AlmaLinux 8, fixing ten CVEs (CVE-2026-112391, CVE-2026-112402, CVE-2026-112392, CVE-2026-112397, CVE-2026-112405, CVE-2026-112894, CVE-2026-112895, CVE-2026-112406, CVE-2026-96640 and CVE-2026-112892) — image-parsing memory flaws including loop-allocation issues (CWE-835), aggregate CVSS 7.5. Update with dnf update python3-pillow (or the platform-pillow package) and restart applications using it.

High 7.5 CVSS 2026-10-30

AlmaLinux 8

What this means under a SharedLicense license

Pillow processes user-uploaded images across web applications — memory-corruption and unbounded-allocation flaws there turn a malicious image upload into crashes or code execution inside the application.

Type:

security

Severity:

important

Release date:

2026-10-30

Description:

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* pillow: Pillow: Denial of Service via unbounded recursion in PDF parser (CVE-2026-112391)
* pillow: pillow: Denial of service via double free during image transformation (CVE-2026-112402)
* pillow: pillow: Denial of Service via zero-size images in rank filters (CVE-2026-112392)
* pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images (CVE-2026-112397)
* pillow: Pillow: Denial of Service via null pointer dereference in Image.merge() (CVE-2026-112405)
* pillow: pillow: Denial of Service via crafted multi-frame image conversion (CVE-2026-112894)
* pillow: pillow: Denial of service via crafted PDF during append operations (CVE-2026-112895)
* pillow: pillow: Denial of Service via infinite loop during PDF page rewriting (CVE-2026-112406)
* pillow: pillow: Denial of Service via duplicate page references in PDF files (CVE-2026-96640)
* pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder (CVE-2026-112892)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	python3-pillow-devel-5.1.1-33.el8_10.aarch64.rpm	277dc9fd5618943a3d689679eb22ef14631280aa56171f36e4b947af64568d6d
aarch64	python3-pillow-tk-5.1.1-33.el8_10.aarch64.rpm	613b1da10aa1ee0587881719170a4aaa4b22c128f66f1b77da43dc7d50a928ea
aarch64	python3-pillow-5.1.1-33.el8_10.aarch64.rpm	7efdc285f72e624893b93779d1b028b1a0863120f78c85cb71272a6627a0d2c2
i686	python3-pillow-5.1.1-33.el8_10.i686.rpm	c4b93c7d40d6ae1819210128ed27b9a333f4987925011c689f59c19fe790e12c
i686	python3-pillow-devel-5.1.1-33.el8_10.i686.rpm	e2f6d4bf5a972854f506349c48183bab66481b5a522c941f1a087d750e871953
noarch	python3-pillow-doc-5.1.1-33.el8_10.noarch.rpm	149e91005220a9891d610ee2a9f680ea13889a93303f0935d89e58a5c5510534
ppc64le	python3-pillow-5.1.1-33.el8_10.ppc64le.rpm	2df3a7a452530a65b7397502850711bab0cbb8df6311f2e086ba837e3b54b455
ppc64le	python3-pillow-devel-5.1.1-33.el8_10.ppc64le.rpm	2f649dbfcf2a88e8fd79aeaff3288e4cb8cbb37d1c43728b74846f54f3b80a93
ppc64le	python3-pillow-tk-5.1.1-33.el8_10.ppc64le.rpm	84f4c2abb3c8a77cb1872684ecf14863c1822688a98de459f0e7a01b3a5aa909
s390x	python3-pillow-devel-5.1.1-33.el8_10.s390x.rpm	072fc4d04265e3b2908292c9b9c88c9486f9d2d60023a1bd2008dfd0962028aa
s390x	python3-pillow-tk-5.1.1-33.el8_10.s390x.rpm	5ca34f6fb207148e73ee209a9bde8698898f53e041380061d7ee9094a9778947
s390x	python3-pillow-5.1.1-33.el8_10.s390x.rpm	ad312b9d4bb63ce031bb16a086390b29ace3dcb3a8bb2679b3bcb59e7c7e8063
x86_64	python3-pillow-tk-5.1.1-33.el8_10.x86_64.rpm	0e7578af1563d3b72491bd95146841f5750f4543f207fafb1f0b78a3755fe3d8
x86_64	python3-pillow-5.1.1-33.el8_10.x86_64.rpm	1239e8d6e6125f66cb13ac3b4721a952346c7709a3ca73a84c6c56b5f91f097f
x86_64	python3-pillow-devel-5.1.1-33.el8_10.x86_64.rpm	eaccc6637e9d109236b6a3d01fa5dbe2e14f99b1bde26907afb9107610d1c149

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Frequently Asked Questions

What is ALSA-2026:92639?

It is AlmaLinux's Python-Pillow erratum for AlmaLinux 8, fixing ten CVEs (CVE-2026-112391, CVE-2026-112402, CVE-2026-112392, CVE-2026-112397, CVE-2026-112405, CVE-2026-112894, CVE-2026-112895, CVE-2026-112406, CVE-2026-96640, CVE-2026-112892) — image-parsing flaws including uncontrolled loop allocation (CWE-835), aggregate CVSS 7.5.

Who is affected?

AlmaLinux 8 servers with Pillow installed — every Python web application that handles image uploads or conversions. If Pillow is present, crafted images can reach the vulnerable parsing code.

How do I apply the fix?

Run dnf update python3-pillow (or the relevant Pillow package for your Python version) and restart the applications using it — image-processing workers reload the patched library on restart.

Why do image libraries get so many CVEs?

Image formats are complex and parser-reachable from the internet: every upload is a parser input. Batches of ten are normal for Pillow and peers — which is why image-processing libraries belong on every server's regular update list.

References

Security Advisories

Related Advisories

Qt5-Qtdeclarative Security Update — AlmaLinux 8 (ALSA-2026:96075)

2026-11-10

Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:96080)

2026-11-09

Util-Linux Security Update — AlmaLinux 8 (ALSA-2026:96212)

2026-11-09

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System