Pillow vulnerabilities put image-processing servers at risk
Pillow vulnerabilities affecting several image formats could expose Python-based websites and services to crashes or command execution when they process untrusted files. The maintainers addressed the flaws in Pillow 13.0.0, released on October 16. No exploitation of the vulnerabilities is currently known, but some attack paths can be reached through ordinary image-upload and thumbnail workflows.
Pillow is a Python software library used to open, convert, resize and save images. One of the fixed flaws, CVE-2026-112900, affects its handling of Encapsulated PostScript (EPS) images. Pillow sends an EPS filename to Ghostscript, a separate program used to convert the image into pixels, without first checking whether the name could be interpreted as an instruction. A specially selected filename can make Ghostscript refer to another file containing operating system commands.
The dangerous input is the filename rather than the contents of the EPS document. Consequently, even a harmless image could trigger the flaw if an attacker controls the name under which it is opened. Upload forms are a practical concern when an application retains a user-provided filename or builds a stored filename from user input. The path is available only on systems that have the Ghostscript command, called gs, installed. Pillow requires that program to open EPS files. The issue affects Pillow versions 2.6.0 through 12.3.0.
Pillow's maintainers classify CVE-2026-112900 as moderate because exploitation requires control over the filename. The CVE record assigned by GitHub gives it a score of 9.2 out of 10 for the same underlying condition. CISA analysts indicate in the record that there is no known exploitation. The difference illustrates that a numerical severity score does not necessarily capture whether a particular website exposes the required filename and Ghostscript conditions.
The library is widely present in web upload forms, avatar and thumbnail generators, document and PDF processing systems, and machine-learning projects. OX Security, whose report brought attention to the issues, estimates that Pillow receives about 436 million downloads each month. That figure does not represent the number of vulnerable servers, but it shows how commonly the package can appear directly or as a dependency of other software.
Version 13.0.0 contains fixes spanning four severity levels, from low to critical. The maintainers place two groups of fixes in their highest tier. One addresses stale image data being reused after an image mode change. The other covers two buffer overflows, errors in which software writes beyond the memory area reserved for data, associated with image decoding.
One of those overflow paths involves the FlashPix (FPX) format. It was demonstrated to run an attacker's command when an application made a single Image.open() call on a crafted file, provided that the optional olefile package was installed. Pillow identifies FlashPix data from the file's contents rather than its extension. A service that automatically opens untrusted uploads could therefore reach the vulnerable code even if the uploaded file did not use an expected FPX filename extension.
A separate issue, CVE-2026-112403, causes a memory buffer overflow when software creates a thumbnail from a crafted lossless JPEG image. Its advisory reports a process crash rather than command execution. According to that advisory, Anthropic found the bug using Claude in an open-source software security project, and Ada Logics manually validated it. The work is part of a broader Anthropic effort that has identified hundreds of flaws in open-source libraries.
CVE-2026-112393 concerns compressed Tagged Image File Format (TIFF) images and has existed in Pillow since 2013. It can overflow memory when an application saves a compressed TIFF into an in-memory buffer, such as io.BytesIO, instead of writing it to a file on disk. This pattern can occur when an online service re-encodes an uploaded image and immediately returns it. The reporters crashed the process through this flaw and achieved command execution only by combining it with a separate weakness that disclosed memory addresses. Saving the TIFF directly to a disk file is not affected.
GitHub-assigned CVE records score the EPS issue, the lossless JPEG thumbnail flaw and the TIFF flaw at 9.2 out of 10. Their practical impact still depends on conditions that the scores do not express, and the maintainers rate the wider set from moderate to critical. The records show a public proof of concept for the TIFF flaw, while none of the reported Pillow vulnerabilities is known to be under active attack.
Administrators should upgrade to Pillow 13.0.0 and rebuild containers, Python package files and base images that include an older release. Pillow 13 no longer supports Python 3.10, so systems using that Python version must move to Python 3.11 or newer as part of the update. The package can then be upgraded with pip using the requirement Pillow version 13.0.0 or later.
Where an immediate update is not possible, Pillow's guidance recommends keeping Ghostscript off hosts that process untrusted uploads and ensuring attackers cannot choose EPS filenames passed to Image.open(). For untrusted JPEGs, applications should avoid draft() and thumbnail(), call load() before those operations, or set reducing_gap to None. Services receiving user images should also treat saving compressed TIFF files to an in-memory buffer as a sensitive operation. For organisations reviewing the infrastructure behind image-processing websites, AEU-I provides security-first IT, infrastructure and consulting. These temporary restrictions reduce individual paths, but moving to the fixed Pillow release addresses the complete set described here.