Pillow 13.0.0 fixes 40 security advisories in the Python imaging library, including a critical FlashPix decoder heap overflow (CVE-2026-112398) that runs code when a crafted file is opened
The Pillow maintainers released Pillow 13.0.0 on 16 October 2026 (UTC) and published 40 GitHub security advisories for it on 17 October: two rated critical, 13 high, 22 medium and three low. The most serious, CVE-2026-112398, is a heap buffer overflow in the FlashPix (FPX) JPEG-tile decoder; the reporter shows code execution from a single crafted file passed to Image.open(), and because Pillow detects FPX by its content rather than its extension, any service that opens or thumbnails untrusted uploads is reachable when the optional olefile package is installed. Other high-severity fixes include JPEG encoder and decoder heap overflows (CVE-2026-96778 when re-saving a JPEG with its colour profile, CVE-2026-112403 via Image.thumbnail()), TIFF out-of-bounds reads that can leak heap memory into pixels, and a heap-buffer-overflow write in the OpenJPEG library bundled in every Pillow wheel since 11.1.0 (CVSS 3.1 8.1), which a patched operating system does not fix. CVE-2026-112900 is a Ghostscript argument injection in EPS handling when a file name starts with a dash. Most of the rest are denial-of-service bugs (decompression-bomb bypasses, infinite loops, quadratic parsing). Some were found by Anthropic using Claude and validated by Ada Logics. Red Hat began listing the CVEs on 19 October. A further medium advisory published 19 October (Arrow export leaking heap memory when PILLOW_ALIGNMENT is above 1) also affects 13.0.0 and has no fixed release yet. No exploitation has been reported. Primary: Pillow on GitHub.
- Product
- Pillow (Python Imaging Library fork), used by many Python web apps, ML pipelines and document tools
- Versions
- Affected: up to 12.3.0 (ranges differ per advisory; the bundled OpenJPEG bug affects wheels 11.1.0 to 12.3.0). Fixed: 13.0.0 (drops Python 3.10).
- CVSS
- Critical (maintainer rating, no CVSS score published) for CVE-2026-112398; 8.1 (CVSS 3.1) for the bundled OpenJPEG overflow
- Exploited in Australia?
- unknown
- Patch to
- Upgrade to Pillow 13.0.0 (needs Python 3.11 or later) in every virtualenv, container image and vendored copy, and rebuild images that pin older wheels; check distribution packages as Red Hat and others ship fixes. Until then, uninstall olefile if you don't need FlashPix, set Image.MAX_IMAGE_PIXELS, restrict accepted formats with Image.open(formats=[...]), avoid EPS (Ghostscript) on untrusted input, and process uploads in a sandboxed worker with memory and time limits. Don't set PILLOW_ALIGNMENT above 1 when exporting to Arrow.
Primary: Pillow GHSA-5x8w-8jj5-q52h — FlashPix (FPX) JPEG decoding heap buffer overflow leads to code execution (CVE-2026-112398, critical; 17 Oct 2026) · Vendor: Pillow 13.0.0 release (16 Oct 2026 UTC) and release notes · CVE: CVE-2026-112398, CVE-2026-96778, CVE-2026-112403, CVE-2026-112900 · Pillow — full list of GitHub security advisories