Pillow — Critical Remote Code Execution and Buffer Overflow Vulnerabilities in Python’s Imaging Library (CVE-2026-112900)

Publication date: October 23, 2026
Category: Vulnerability / Web Security

Introduction

The Pillow library, recognized as the most widely adopted image processing framework within the Python ecosystem with approximately 436 million monthly downloads, has been impacted by multiple high-severity vulnerabilities. Initially highlighted by security firm OX Security alongside findings aided by artificial intelligence and validated by Ada Logics, these critical flaws enable operating system command execution, memory buffer overflows, and heap corruption. Project maintainers have addressed these issues by releasing version 13.0.0, which remediates vectors affecting various graphical formats including EPS, JPEG, and TIFF.

What is Pillow? (General Analysis)

Pillow serves as the modern fork and successor to the original Python Imaging Library (PIL). It plays a crucial role in modern web applications, document processing pipelines, and machine learning workflows, managing everyday tasks such as thumbnail generation, format conversion, and user-uploaded image parsing. Because this library is embedded across millions of servers and data pipelines, any flaw in handling graphical payloads immediately transforms into a mass-scale vector targeting the underlying infrastructure.

The reported vulnerabilities correspond to the following identifiers and official classifications verified within the NVD database:

  • CVE-2026-112900: Argument injection in Ghostscript for EPS inputs.
    • Official CVSS v4.0 Vector (Confirmed): CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (Score: 9.2 CRITICAL).
    • Official CWE Classification (Confirmed): CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and CWE-88 (Improper Neutralization of Argument Delimiters in a Command).
  • CVE-2026-112403: Buffer overflow in the JPEG decoder when processing lossless compressed formats.
    • Official CVSS v4.0 Vector (Confirmed): CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (Score: 9.2 CRITICAL).
    • Official CWE Classification (Confirmed): CWE-122 (Heap-based Buffer Overflow).
  • CVE-2026-112393: Heap buffer overflow and stale heap disclosure when saving compressed TIFF data.
    • Official CVSS v4.0 Vector (Confirmed): CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (Score: 9.2 CRITICAL).
    • Official CWE Classification (Confirmed): CWE-122 (Heap-based Buffer Overflow).

How Does It Work? (Technical Analysis)

In-depth analysis of these incidents reveals that the flaws do not stem from the visual structure of images, but rather from improper handling of metadata, filenames, and internal buffer workflows:

  • EPS Injection Flow (CVE-2026-112900):
    • Exploit Entry: The EpsImagePlugin.Ghostscript module invokes the external gs executable by passing the caller-controlled filename without converting it to a safe absolute path.
    • Execution: If an attacker controls the filename to begin with a hyphen or utilizes an argument starting with @ pointing to a text file containing extra arguments, Ghostscript interprets these strings as configuration options rather than plain file names. This enables arbitrary command execution even under the default -dSAFER invocation.
  • JPEG Memory Corruption (CVE-2026-112403):
    • Mechanism: When processing lossless SOF3 JPEG images using builds linked against libjpeg-turbo 3.x while requesting downscaling operations via draft() or thumbnail(), the decoder (ImagingJpegDecode) fails to validate the actual output width returned by the underlying library.
    • Impact: A full-width scanline is written into a buffer sized for a requested draft scale, corrupting heap memory, crashing the process, or facilitating code execution.
  • TIFF Overflow and Disclosure (CVE-2026-112393):
    • Mechanism: When saving compressed TIFF data via libtiff to targets lacking a usable file descriptor (such as BytesIO objects), the internal callback _tiffWriteProc sizes its memory allocation based on the prior buffer size instead of the current write position.
    • Exploitation: Out-of-line TIFF tags controlled by the attacker allow exceeding the initial allocation as the pointer advances, which combined with unwritten alignment gaps larger than 64 KiB, exposes stale heap bytes.

Affected Systems / Environments

Pillow versions ranging from 2.6.0 up to 12.3.0 are vulnerable (fixed in version 13.0.0). Most exposed environments include web services featuring file upload endpoints that preserve user-supplied filenames, alongside systems processing images via Ghostscript or dependencies relying on libjpeg-turbo 3.x and libtiff.

CVE Category (CWE) Impact CVSS Vector (summary)
CVE-2026-112900 CWE-78, CWE-88 RCE / Injection 9.2 (CRITICAL) AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H
CVE-2026-112403 CWE-122 Memory Corruption / DoS 9.2 (CRITICAL) AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H
CVE-2026-112393 CWE-122 Memory Corruption / Leak 9.2 (CRITICAL) AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H

Mitigation and Detection

Remediation

  • Priority Update: Immediately upgrade the Pillow library to version 13.0.0 or later using pip install -U "Pillow>=13.0.0". Note that this version drops support for Python 3.10, requiring Python 3.11 or newer.
  • Ghostscript Hardening: Remove or restrict the installation of the gs binary on hosts processing untrusted image inputs, avoiding the passing of user-controlled filenames to Image.open() for EPS files.
  • Flow Isolation: Avoid utilizing downscaling methods (draft() or thumbnail()) on untrusted JPEGs without pre-loading safeguards, and treat saving TIFF files to in-memory buffers (io.BytesIO) as sensitive paths.

Detection

  • Monitor operational logs for unusual filename patterns within upload requests containing control characters, leading hyphens, or command argument references.
  • Implement static dependency analysis within CI/CD pipelines to identify vulnerable Pillow versions across containers and production deployments.

“The exploitation of vulnerabilities in low-level libraries like Pillow highlights how improper sanitization of metadata and filenames can transform routine graphical operations into direct avenues for remote command execution.”

Wrapping Up

The vulnerabilities discovered in Pillow underscore the criticality of open-source dependencies within the modern software supply chain. With CVSS scores of 9.2 and vectors spanning argument injection to heap memory overflows, upgrading to version 13.0.0 is an essential requirement to protect the stability and integrity of corporate platforms and web services handling multimedia content.

References