Invalid-free in _dealloc

概要

Crash type: Invalid-free
Crash state:
_dealloc
_Py_DECREF
frame_dealloc

参考情報

• bugs.chromium.org/p/oss-fuzz/issues/detail · REPORT

pillow のその他の脆弱性

• GHSA-78g4-xqwv-q3g8高 8.1Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load…
• CVE-2026-114501中 5.3Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports f…
• CVE-2026-112902高 Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
• CVE-2026-96778高 8.8Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker()…
• CVE-2026-96644高 8.1Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to t…