CVE-2026-112392

Affected versions of the Pillow package are vulnerable to NULL Pointer Dereference due to missing validation of zero-size images before accessing pixel data. The `ImagingExpand()` function in `src/libImaging/Filter.c`, which is invoked by `RankFilter.filter()` (and therefore by `MedianFilter`, `MinFilter`, and `MaxFilter`) through the core `expand()` method, reads `imIn->image[y][0]` and the first/last rows to replicate edge pixels without checking whether the input image has any pixels, so when `ImagingAllocateArray` leaves the line pointers NULL for a zero-width or zero-height image, the first read dereferences NULL. An attacker who can supply crop coordinates with equal left/right or top/bottom edges, or an uploaded multi-page TIFF whose second IFD declares a zero `ImageLength`, can cause `Image.filter()` to be called on a zero-size image and crash the entire Python process with SIGSEGV, resulting in a Denial of Service.