Pillow 13.0.0 Fixes Code-Execution Flaw Triggered by a Filename, Plus Several Memory Bugs

Since Pillow's maintainers released version 13.0.0 on October 16, advisories covering the Python image library's flaws have been published almost daily, with the latest listed October 22. The release is a large security update. It carries fixes across four severity levels, and the maintainers rate two of them critical.

None of the flaws is known to be under attack.

The filename bug

The headline issue is CVE-2026-112900. Pillow opens EPS images by handing the file's name to Ghostscript, a separate program that renders the image. It does not check the name first.

A name that begins with a dash gets read by Ghostscript as an option, not a file. Oxford Security's analysis says that combined with Ghostscript's `@argfile` syntax, an attacker who controls the filename can inject options and run arbitrary commands, even under the default `-dSAFER` mode.

The advisory puts it plainly: "The flaw is triggered by the filename, not by anything in the PostScript document." A harmless-looking EPS file is enough if the attacker sets the name.

The realistic targets are upload endpoints that store or build a file's name from user input. Hosts need the `gs` program installed for the bug to reach Ghostscript at all. Affected versions run from 2.6.0 up to 12.3.0.

Moderate or critical?

The severity rating is disputed. Pillow's maintainers rate the EPS flaw moderate, because the attacker must control the filename. The CVE record assigned by GitHub scores the same condition 9.2 out of 10.

Oxford Security sides with the higher number and calls three of the Pillow bugs critical at CVSS 9.2. The maintainers' own critical tier covers different items.

The other fixes

Two fixes sit in the maintainers' top tier. One is a memory bug the release notes describe as stale image data reused after a mode change. The other covers two overflow flaws in JPEG decoding.

One of the JPEG flaws, in the FlashPix (FPX) format, was shown to run an attacker's command from a single `Image.open()` call on a crafted file. It requires the optional olefile package. Pillow identifies these files by content, not extension, so a server that opens untrusted uploads can be hit with no user action.

The other, CVE-2026-112403, overflows a buffer when a program makes a thumbnail of a crafted lossless JPEG. Its advisory reports a crash, not code execution. Oxford Security says the overflow could potentially lead to code execution. The advisory says Anthropic found the bug using Claude and Ada Logics validated it manually.

A third flaw, CVE-2026-112393, has been in Pillow since 2013. It overflows a heap buffer when a program saves a compressed TIFF to memory, such as an `io.BytesIO` object, rather than to a file on disk. Oxford Security says output larger than 64 KiB triggers it and that stale heap bytes can also leak. Saving to a real file path is not affected.

More listings since the release

Red Hat's entry for CVE-2026-112897, published October 19, covers a TIFF decoding problem. From version 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels after a short libtiff decode of JPEG-compressed or Group 4 fax data. It discloses stale heap contents without a crash or memory corruption. It carries a CVSS 4.0 score of 8.7. Rapid7's database, which added the entry October 21, lists no solution for Red Hat's package.

Another advisory, GHSA-78G4-XQWV-Q3G8, published October 22, covers a heap overflow in the libopenjp2 library bundled in Pillow's PyPI binary wheels. It affects versions 11.1.0 through 12.x and is scored 7.5. It involves crafted JPEG 2000 files and can cause remote code execution or a crash. The fix applies the upstream openjpeg 2.5.4 patch to the wheel build. The advisory's mitigation advice is to upgrade to 13.0.0 or higher and, if building from source, update the host's libopenjp2 libraries. It also advises rejecting JPEG 2000 images if they are not needed.

Why the reach is wide

OX Security, whose report drew attention to the flaws, estimates Pillow is downloaded about 436 million times a month. It sits behind web upload forms, avatar and thumbnail tools, and document and PDF pipelines. Most Python machine-learning projects pull it in directly or as a dependency of something else.

Many teams never chose Pillow. It arrived inside another package, and nobody is tracking its version.

What comes next

The fix for every issue above is the same: upgrade to Pillow 13.0.0. Teams that cannot move immediately can look at the specific conditions each bug needs. The EPS flaw requires Ghostscript on the host and attacker control of the filename. The FPX flaw requires olefile. The TIFF memory-save bug requires saving to an in-memory object.

It is unclear how quickly distribution packages catch up. Rapid7's listing for Red Hat's Pillow package showed no available solution as of its October 21 entry, and the advisories do not say when downstream builds will carry 13.0.0.