Pillow 13.0.0 fixes critical flaws that can turn image processing into code execution

The maintainers of Pillow, Python's most widely used image library, have released version 13.0.0 to fix a batch of vulnerabilities, including a flaw that can let attackers execute commands on servers that process uploaded images, The Hacker News reported on October 23. The release shipped on October 16, and security firm OX Security, which drew attention to the flaws, estimates Pillow is downloaded about 436 million times a month.

What happened

The most prominent bug, CVE-2026-112900, affects Pillow versions 2.6.0 through 12.3.0. According to the report, Pillow opens EPS files by passing the filename to Ghostscript without validating it, so an attacker-chosen name can make Ghostscript treat it as instructions and load a second file containing commands. The issue depends on the filename rather than the image content, meaning even a harmless EPS file can be dangerous if an attacker controls its name. Upload endpoints that store files under user-supplied names are the likely target. Pillow's maintainers rate the flaw moderate because of that precondition, while GitHub's CVE record scores it 9.2.

Technical details

The Hacker News reports that the release fixes issues across four severity levels, two of which maintainers rate as critical:

• A memory bug that can reuse stale image data after a mode change.
• A flaw in FlashPix (FPX) handling that, according to the article, can let a single Image.open() call on a crafted file run a command when the optional olefile package is installed. Because Pillow identifies files by content rather than extension, servers opening untrusted uploads are exposed.
• CVE-2026-112403, a buffer overflow when creating thumbnails from crafted lossless JPEGs. The advisory reports a crash rather than code execution.
• CVE-2026-112393, a buffer overflow dating back to 2013 that triggers when a compressed TIFF is saved to memory. Code execution required a second, separate memory leak flaw.

The publication noted inconsistencies in how the FPX flaw is described, and said GitHub's 9.2 scores do not capture the conditions each bug depends on.

Who is affected

Pillow is common in upload forms, avatar and thumbnail tools, document and PDF pipelines and machine learning projects. The EPS flaw requires the Ghostscript gs program to be installed. CISA's records mark no known exploitation for these issues, though a public proof of concept exists for CVE-2026-112393, according to the report.

What to do

• Upgrade to Pillow 13.0.0 or later and rebuild containers, wheels and base images that bundle older copies. Pillow 13 drops Python 3.10, so those environments need Python 3.11 or newer.
• Until upgrades are complete, keep gs off hosts that process untrusted uploads and never pass attacker-controlled filenames to Image.open() for EPS files.
• Avoid draft() and thumbnail() on untrusted JPEGs, or call load() first.
• Treat saving user-supplied images as TIFF to in-memory buffers as a sensitive code path.