CVE-2026-112402

Affected versions of the Pillow package are vulnerable to Use After Free (CWE-416) due to `ImagingScaleAffine()` deleting an `Imaging` structure it does not own when its internal allocation fails. When `calloc()` for the per-column lookup table fails inside `ImagingScaleAffine()` in `src/libImaging/Geometry.c`, the function calls `ImagingDelete(imOut)` even though, when reached via `Image.transform()`, `imOut` is the struct backing a live Python `ImagingCore` object; `_dealloc()` in `src/_imaging.c` subsequently calls `ImagingDelete()` on the same struct again, writing to and freeing already-freed memory. An attacker who can control the output size passed to `Image.transform()` (via `Transform.EXTENT` or `Transform.AFFINE` with a pure scale/translate matrix and default NEAREST resampling) can request a very wide, single-row output so that the output image allocates successfully while the larger lookup table allocation fails, triggering the double free and crashing the worker process with corrupted heap state, which is especially reachable on workers constrained by an address-space limit (`ulimit -v`, `uwsgi --limit-as`, `systemd LimitAS=`) or on 32-bit processes.