CVE-2026-112405

Affected versions of the Pillow package are vulnerable to NULL Pointer Dereference due to insufficient validation of band 0 in `Image.merge()`. The validation loop in `Image.py` only checks the mode and size of `bands[1:]`, leaving band 0 unchecked, so when band 0 is a single-band `I` or `F` image its `image8` plane remains NULL while only `image32` is populated; the native `ImagingMerge` routine in `Bands.c` then dereferences this NULL `image8` pointer when constructing multi-band output. An attacker can exploit this by crafting a malicious IPTC file whose sub-image at index 0 is typed as `I` or `F`, since `IptcImagePlugin.py` builds the band list from this attacker-controlled sub-image and passes it to `Image.merge()` without an accept function to prefilter the file, causing a segmentation fault and crashing the worker process when the file is opened and loaded.