CVE-2026-112893

Affected versions of the Pillow package are vulnerable to Use of Uninitialized Variable due to the FreeType glyph rendering code failing to initialize the `glyph` pointer before use. In `src/_imagingft.c`, the `glyph` variable declared at line 848 is not set to NULL, and the measurement loop can jump to the `glyph_error` cleanup label before `glyph` is ever assigned a valid value; additionally, in the render loop the pointer is not reset to NULL after each call to `FT_Done_Glyph`, leaving a stale reference that is freed again whenever a stroker is active. An attacker can exploit this by supplying a malformed font file (via `ImageFont.truetype`) containing a glyph with an invalid contour count that forces `FT_Load_Glyph` to fail, causing Pillow to call `FT_Done_Glyph` on an uninitialized or stale pointer when rendering text with a non-zero `stroke_width`, resulting in an invalid or double free that can crash the application or potentially be leveraged for further memory corruption.