CyberStack 
https://cyberstack.org/n/pillow-13-0-0-forty-advisories-fpx-heap-overflow-rce-112398-20261017
Vulnerability
Published 2026-10-17
Updated 2026-10-23
Verified 2026-10-24

Pillow 13.0.0 fixes 40 security advisories in the Python imaging library, including a critical FlashPix decoder heap overflow (CVE-2026-112398) that runs code when a crafted file is opened

The Pillow maintainers released Pillow 13.0.0 on 16 October 2026 (UTC) and published 40 GitHub security advisories for it on 17 October: two rated critical, 13 high, 22 medium and three low. The most serious, CVE-2026-112398, is a heap buffer overflow in the FlashPix (FPX) JPEG-tile decoder; the reporter shows code execution from a single crafted file passed to Image.open(), and because Pillow detects FPX by its content rather than its extension, any service that opens or thumbnails untrusted uploads is reachable when the optional olefile package is installed.

Other high-severity fixes include JPEG encoder and decoder heap overflows (CVE-2026-96778 when re-saving a JPEG with its colour profile, CVE-2026-112403 via Image.thumbnail()), TIFF out-of-bounds reads that can leak heap memory into pixels, and a heap-buffer-overflow write in the OpenJPEG library bundled in every Pillow wheel since 11.1.0 (CVSS 3.1 8.1), which a patched operating system does not fix. CVE-2026-112900 is a Ghostscript argument injection in EPS handling when a file name starts with a dash.

Most of the rest are denial-of-service bugs (decompression-bomb bypasses, infinite loops, quadratic parsing). Some were found by Anthropic using Claude and validated by Ada Logics. Red Hat began listing the CVEs on 19 October.

A further medium advisory published 19 October (Arrow export leaking heap memory when PILLOW_ALIGNMENT is above 1) also affects 13.0.0 and has no fixed release yet.

No exploitation has been reported. Primary: Pillow on GitHub.

UPDATE (23 Oct 2026): The CVE records published by GitHub, the CVE numbering authority, on 19 October (UTC) score four of the flaws 9.2 under CVSS 4.0: CVE-2026-112398 (FlashPix decoding), CVE-2026-112403 (JPEG decoding after draft()), CVE-2026-112393 (heap buffer overflow when saving TIFF to BytesIO) and CVE-2026-112900 (argument injection in the Ghostscript call, potentially leading to code execution). The maintainers' own advisories rate those four critical, high, high and medium respectively.

In the same records, CISA's ADP enrichment records a public proof of concept for CVE-2026-112398, CVE-2026-112403 and CVE-2026-112393, and no known exploitation for CVE-2026-112900.

Pillow 13.0.0 remains the fixed release. (source: CVE.org records)

Product
Pillow (Python Imaging Library fork), used by many Python web apps, ML pipelines and document tools
Versions
Affected: up to 12.3.0 (ranges differ per advisory; the bundled OpenJPEG bug affects wheels 11.1.0 to 12.3.0). Fixed: 13.0.0 (drops Python 3.10).
CVSS
(CVSS 4.0, CVE record from GitHub) for CVE-2026-112398, CVE-2026-112403, CVE-2026-112393 and CVE-2026-112900 (maintainer ratings: critical, high, high, medium); 8.1 (CVSS 3.1) for the bundled OpenJPEG overflow
Exploited in Australia?
unknown
Patch to
Upgrade to Pillow 13.0.0 (needs Python 3.11 or later) in every virtualenv, container image and vendored copy, and rebuild images that pin older wheels; check distribution packages as Red Hat and others ship fixes. Until then, uninstall olefile if you don't need FlashPix, set Image.MAX_IMAGE_PIXELS, restrict accepted formats with Image.open(formats=[...]), avoid EPS (Ghostscript) on untrusted input, and process uploads in a sandboxed worker with memory and time limits. Don't set PILLOW_ALIGNMENT above 1 when exporting to Arrow.

vulnerabilities