Pillow: Critical RCE flaws in Python image library via crafted EPS filenames and JPEG/TIFF buffers (CVE-2026-112900, CVE-2026-112403, CVE-2026-112393)
Severity: critical · Patch status: patched · Since 2026-10-16 · CVE-2026-112393, CVE-2026-112398, CVE-2026-112403, CVE-2026-112900
Pillow, the most widely used Python image library (~436M downloads/month), fixed a batch of vulnerabilities in version 13.0.0 released 2026-10-16. The headline flaw, CVE-2026-112900, lets an attacker run OS commands by controlling the filename of an EPS image, which Pillow passes unvalidated to Ghostscript; it affects versions 2.6.0–12.3.0 and only hosts with the gs binary installed. Two maintainer-critical fixes cover a stale-image-data memory bug and JPEG decoding overflows, including an FPX flaw enabling RCE from a single Image.open() call when olefile is installed, and CVE-2026-112403, a lossless-JPEG thumbnail buffer overflow. CVE-2026-112393, present since 2013, overflows a buffer when saving compressed TIFFs to in-memory buffers. No exploitation is known; a public PoC exists for the TIFF flaw. One JPEG flaw was found by Anthropic using Claude and validated by Ada Logics.
What to do
- Upgrade to Pillow 13.0.0 and rebuild containers, wheels, and base images bundling older copies; note Python 3.10 is dropped, so ensure Python 3.11+
- Until upgraded, keep the Ghostscript gs binary off hosts processing untrusted uploads and never pass attacker-controlled filenames to Image.open() for EPS
- Avoid draft()/thumbnail() on untrusted JPEGs, or call load() first or pass reducing_gap=None
- Treat saving user-supplied TIFF images to in-memory buffers (e.g. io.BytesIO) as a sensitive path
Fixed versions
Sources
All live incidents on Threat Watch
