{"metadata": {"vulnerability": "CVE-2026-112893", "count": 13, "kinds": {"milestone": 5, "sighting": 2, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-10-17T10:40:17Z", "date_only": false, "value": "2026-10-17T10:40:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47", "record": "CVE-2026-112893", "field": "creation_timestamp", "uuid": "ebb064e5-7147-4446-bf6d-d37906e67684", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47"}, {"timestamp": "2026-10-19T20:16:09.856Z", "date_only": false, "value": "2026-10-19T20:16:09.856Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-112893", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-19T21:53:49.979Z", "date_only": false, "value": "2026-10-19T21:53:49.979Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-112893", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-19T21:53:49.979Z", "date_only": false, "value": "2026-10-19T21:53:49.979Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-112893", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-19T21:53:49.979Z", "date_only": false, "value": "2026-10-19T21:53:49.979Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-112893", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T21:59:29.388Z", "date_only": false, "value": "2026-10-19T21:59:29.388030Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117469817582058726", "record": "CVE-2026-112893", "field": "creation_timestamp", "uuid": "b51ead7e-03c7-4baa-bf90-1c2f69d6a765", "content": "CVE-2026-112893 Pillow: Invalid free in FreeType glyph rendering when a stroker is active Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-112893https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47https://github.com/python-pillow/Pillow/commit/a7416de7f3a43128179d2cf68df3240ea8dafe13https://github.com/python-pillow/Pillow/releases/tag/13.0.0#python-pillow #Pillow#CVE_2026_112893#bot", "url": "https://infosec.exchange/users/cve/statuses/117469817582058726"}, {"timestamp": "2026-10-19T22:17:09Z", "date_only": false, "value": "2026-10-19T22:17:09Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-J4M9-6W36-PW47", "record": "GHSA-J4M9-6W36-PW47", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-19T22:17:09.350Z", "date_only": false, "value": "2026-10-19T22:17:09.350", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-112893", "record": "FKIE_CVE-2026-112893", "field": "published"}, {"timestamp": "2026-10-20T19:48:50.250Z", "date_only": false, "value": "2026-10-20T19:48:50.250", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-112893", "record": "FKIE_CVE-2026-112893", "field": "lastModified"}, {"timestamp": "2026-10-21T20:06:34Z", "date_only": false, "value": "2026-10-21T20:06:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-J4M9-6W36-PW47", "record": "GHSA-J4M9-6W36-PW47", "field": "published"}, {"timestamp": "2026-10-21T20:06:34Z", "date_only": false, "value": "2026-10-21T20:06:34Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-J4M9-6W36-PW47", "record": "GHSA-J4M9-6W36-PW47", "field": "modified"}, {"timestamp": "2026-10-22T09:13:55Z", "date_only": false, "value": "2026-10-22T09:13:55Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-AIDER-CVE-2026-112893", "record": "BREW-AIDER-CVE-2026-112893", "field": "published"}, {"timestamp": "2026-10-22T09:13:55Z", "date_only": false, "value": "2026-10-22T09:13:55Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-AIDER-CVE-2026-112893", "record": "BREW-AIDER-CVE-2026-112893", "field": "modified"}]}