Pillow, the most widely used image library for Python, shipped version 13.0.0 on October 16 with a large batch of security fixes. According to The Hacker News, the one that drew attention is CVE-2026-112900: Pillow opens EPS images by passing the file’s name to Ghostscript without checking it, and Ghostscript can treat an attacker-chosen name as instructions and run commands. The advisory says the trigger is the filename, not the picture, so a harmless EPS file can still do damage if an attacker controls its name. It only reaches hosts that have the gs program installed, and applies to Pillow 2.6.0 through 12.3.0. The maintainers rate it moderate because the attacker has to control the filename; the CVE record assigned by GitHub scores it 9.2 out of 10.
The release also fixes two flaws the maintainers rate critical. One is a memory bug where stale image data is reused after a mode change. The other covers two overflows in JPEG decoding. The FlashPix (FPX) one was shown to run an attacker’s command from a single Image.open() call on a crafted file, as long as the optional olefile package is installed; Pillow recognises these files by content, not extension. A third flaw, CVE-2026-112393, has existed since 2013: it overflows a buffer when a program saves a compressed TIFF to memory (for example io.BytesIO) instead of a file. The advisory says researchers crashed the process with it and reached code execution only by combining it with a separate memory-leak flaw. A thumbnail overflow, CVE-2026-112403, was reported to crash only. None of the flaws is known to be under attack; the CVE records for the EPS flaw mark no known exploitation and the TIFF one has a public proof of concept. The thumbnail overflow was found by Anthropic using Claude and validated manually by Ada Logics, per its advisory.
How to check if you’re affected
Affected versions are Pillow releases older than 13.0.0 (the EPS and TIFF advisories list versions up to 12.3.0). Run pip show pillow or python -c "import PIL; print(PIL.__version__)" in each environment, and check requirements files, containers, wheels and base images that bundle an older copy, since Pillow is pulled in by many web upload forms, thumbnail tools, document pipelines and machine-learning projects.
- Upgrade with
pip install -U "Pillow>=13.0.0". Pillow 13 drops Python 3.10, so installs on 3.10 also need Python 3.11 or newer. - Until you can upgrade, per The Hacker News: keep the
gsprogram off any host that processes untrusted uploads and never pass an attacker-controlled filename toImage.open()for EPS; avoiddraft()andthumbnail()on untrusted JPEGs, callload()first, or passreducing_gap=None; and treat saving a user-supplied image as TIFF to an in-memory buffer as a sensitive path.
Sources
- Pillow advisory GHSA-w889-685w-c8fh: argument injection in the Ghostscript call (EPS)
- Pillow advisory GHSA-5x8w-8jj5-q52h: FlashPix (FPX) JPEG decoding heap overflow
- Pillow advisory GHSA-332p-7hrc-92wf: TIFF save to BytesIO heap overflow
- Pillow 13.0.0 release notes
- The Hacker News: Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image