Pillow · Disclosed

Pillow 13.0.0 fixes heap overflows; public PoC executes code via FPX

Oct 22, 2026 · 1 min read

Pillow, the Python imaging library, fixed a critical heap buffer overflow (CVE-2026-112398) in FlashPix (FPX) JPEG decoding in version 13.0.0: opening a single crafted file with Image.open executes attacker commands, and the advisory ships a working PoC. The release also fixes Ghostscript argument injection (CVE-2026-112900), a _tiffWriteProc overflow when saving TIFF (CVE-2026-112393) and a JPEG decoder overflow (CVE-2026-112403). Sources report no active exploitation; upgrade to 13.0.0 and uninstall the optional olefile dependency on services that open uploads.

By HIFY Radar newsroom Updated 10/26/2026 01:11 PM Get this every day →← Back to the feed 4 sources

HighVulnerabilityDisclosedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Pillow, the Python imaging library, released version 13.0.0 fixing four security flaws, including a critical one (CVE-2026-112398) that executes attacker commands when the system merely opens a crafted image file. Services that process uploads, such as thumbnailing and media conversion, can be hit with no user interaction.

Why it matters

Anyone who uploads a crafted FPX file can run commands in the image-processing process, compromising that server and the data and privileges it holds. Every application that opens untrusted files with the optional olefile dependency installed is exposed; detection relies on the OLE2 magic in the content, not the file extension.

What to do

Upgrade Pillow to 13.0.0 across all environments; the version drops Python 3.10 support and includes removals and deprecations, so test before rollout. As an immediate measure, uninstall the olefile dependency from services that open uploads and review handling of EPS files whose names users can control.

For the technical team

CVE: CVE-2026-112398, CVE-2026-112900, CVE-2026-112393, CVE-2026-112403
Affected: Pillow (python-pillow) Pillow (Python imaging library) · pillow <= 12.3.0 for CVE-2026-112398, CVE-2026-112393 and CVE-2026-112403; Pillow 2.6.0 through 12.3.0 for CVE-2026-112900 (Ghostscript).
Exploitation: Sources report no active in-the-wild exploitation. The advisory publishes a working PoC: opening "shell.fpx" runs a command via system@plt on Pillow 12.2.0 (Ubuntu 24.04 x86_64, glibc 2.39) with no user interaction; the Ghostscript RCE was verified in a PoC with Ghostscript 10.02.1 and 10.07.1 with -dSAFER enabled.
Fix: Upgrade to Pillow 13.0.0 (released October 16). FPX mitigation: uninstalling olefile blocks automatic FPX detection by Image.open. For Ghostscript, the fix normalizes the file path to absolute (os.path.abspath) before building the binary's command line.
Vector: FPX (CVE-2026-112398): heap out-of-bounds write in FpxImagePlugin. Image.open detects FPX by the OLE2 magic (D0CF11E0) whenever the optional olefile package is installed, regardless of extension; for the JPEG tile, the buffer is sized for rawmode "LA" (2 bytes/pixel), but with out_color_space JCS_UNKNOWN libjpeg writes num_components bytes/pixel (4, taken from the embedded JPEG's SOF marker), overflowing the buffer with attacker-controlled length and content (CWE-122/787). Ghostscript (CVE-2026-112900): EpsImagePlugin.Ghostscript places fp.name unvalidated at "-f"; a filename starting with "-" or "@" injects arguments (CWE-88), chainable to RCE even with -dSAFER. TIFF (CVE-2026-112393): overflow in _tiffWriteProc when saving TIFF to BytesIO.
More details: Researcher credited for CVE-2026-112398: Alex Bouffard (mixbo@pebwalker.com); advisory published October 17, 2026 and updated October 23, 2026, rated Critical (GitHub Reviewed). The FPX PoC assumes a non-PIE interpreter with ASLR disabled in the demo container, and the embedded command is limited to 7 bytes. The Ghostscript flaw stems from the filename, not the EPS content, and is not covered by the policy of blocking untrusted EPS. The 13.0.0 release also bounds retained TIFF tag data by stream size and validates TIFF tags against libtiff's field definitions.