Pillow before 13.0.0: Ghostscript argument injection from a filename (CVE-2026-112900, 9.2) and two heap overflows (CVE-2026-112403, CVE-2026-112393); upgrade to 13.0.0

View raw markdownEdit on GitHub ↗

TL;DR

Pillow 13.0.0 fixes three advisories the GitHub Advisory Database rates critical, all published on the vendor tab on 2026-10-17 and listed in the database on 10-20 and 10-21. CVE-2026-112900 (GHSA-w889-685w-c8fh, CVSS 4.0 9.2): EpsImagePlugin.Ghostscript passes the input file's name to Ghostscript after -f without making it a safe absolute path, so a filename beginning with - becomes a Ghostscript option and one beginning with @ pulls arguments from a file; the reporter verified command execution with -dSAFER in place, and the trigger is the filename, not the EPS content, so upload handlers that keep user-supplied names are the exposed shape. CVE-2026-112403 (GHSA-8g5g-8vmr-9782, 9.2): thumbnail() requests a reduced-scale JPEG decode and sizes its row buffer for it, libjpeg-turbo 3.x ignores the request for lossless SOF3 files, and full-width rows overflow the buffer; the official wheels bundle libjpeg-turbo 3, and this one was found by Anthropic using Claude and validated by Ada Logics. CVE-2026-112393 (GHSA-332p-7hrc-92wf): a heap overflow in _tiffWriteProc when saving TIFF to BytesIO. The vendor tab holds a further page of 2026-10-17 advisories at moderate and low. This file rates the set high: the 9.2s are the CNA's, and each needs a precondition (Ghostscript installed and an attacker-chosen filename; the draft() path with a large lossless JPEG).

What happened

CVE-2026-112900. GitHub CNA, published 2026-10-19; affected 2.6.0 through 12.x, patched 13.0.0. Mechanism per the advisory: PIL.EpsImagePlugin.Ghostscript() passes fp.name unvalidated as the -f argument. --prefixed names are parsed as options; @-prefixed names are argument-file references that can inject several arguments, and for code execution the attacker also controls the referenced text file. Verified on Ghostscript 10.02.1 and reported to work on 10.07.1. CWE-88, CWE-78; vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H. No workaround is listed; the fix commit is a2c3631. Reporter Chanu Kang (CysecLab, KAIST); remediation radarhere, review hugovk.

CVE-2026-112403. GitHub CNA, published 2026-10-19; affected up to 12.3.0, patched 13.0.0. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested; with libjpeg-turbo 3.0 or later a lossless 8-bit SOF3 JPEG keeps full width and writes past a buffer sized for the draft scale. Reached through Image.thumbnail(), which calls draft(); open().load() and resize() are not affected; builds on libjpeg-turbo 2.x or IJG libjpeg reject the files first. The advisory says an image of at least 1024 pixels per side thumbnailed to 256×256 with defaults triggers it. Workarounds: call load() before thumbnail(), or pass reducing_gap=None. Vector AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, CWE-122; fix commit 242a059. Found by Anthropic using Claude, validated manually by Ada Logics; reporter DavidKorczynski.

CVE-2026-112393. Listed by the database on 2026-10-21 as "Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO," Critical, Pillow; this sweep read the listing row and not the advisory page, so no range beyond "before 13.0.0" and no vector is stated here.

The rest of the tab. Page one of seven (read 2026-10-22) holds ten more advisories dated 2026-10-17 and 10-19 without CVE ids: a bundled libopenjp2 2.5.4 heap overflow reachable from Image.open().load() (High), several quadratic or infinite-loop denials of service in GIF, PDF and XBM handling, an Arrow-export heap leak, an EPS decompression-bomb bypass, and a NULL dereference. Pages two to seven were not walked.

Registry. pip index versions pillow, read 2026-10-22: 13.0.0 is the newest.

Why it is here: Pillow is the image library under FastAPI and Django upload handlers, Streamlit apps and most Python agent tools that look at a picture, and the Ghostscript bug is reachable from the one field those handlers least often sanitise, the filename.

Am I affected?

  • pip show pillow; anything below 13.0.0.
  • For CVE-2026-112900: Ghostscript installed on the host (gs --version), EPS accepted or sniffed as input, and a code path where a user-chosen filename reaches Image.open() or EpsImagePlugin. Saving uploads under their original names and opening them by path is the exposed pattern.
  • For CVE-2026-112403: thumbnail() on untrusted JPEGs with the official wheels (libjpeg-turbo 3). PIL.features.version("jpg") shows the bundled version.

If you are affected

  1. pip install -U "pillow>=13.0.0", rebuild images, redeploy.
  2. Until then: never pass a user-supplied name to Ghostscript paths, store uploads under generated names, and call load() before thumbnail() or pass reducing_gap=None.
  3. A host that processed attacker-chosen EPS filenames with Ghostscript present while unpatched should be treated as possibly compromised: if your webapp was compromised, then rotating cloud credentials.

Prevention

Update 2026-10-26 — two more Critical Pillow records, both fixed in the same 13.0.0

  • CVE-2026-112398 / GHSA-5x8w-8jj5-q52h (database 10-23, CVSS 9.2): heap overflow decoding JPEG data embedded in FlashPix (FPX) containers, Pillow through 12.3.0, fixed 13.0.0; reachable only when olefile is installed, which most image-upload stacks do not have; credit Alex Bouffard.
  • CVE-2026-96639 / GHSA-v9pv-5gc8-w2m6 (database 10-22, CVSS 9.8): stale image storage reused across frames in multi-frame formats (PSD, MPO, DCX, MIC), Pillow 11.0.0 up to but not including 13.0.0, fixed 13.0.0 (PR #10105); credit Rotem Kama.

Nothing changes in the action: 13.0.0 is the fix for all six ids now in this file (the sixth, a BMP denial of service, was added on 10-27 below). If 13.0.0 cannot be taken yet, reject FPX, PSD, MPO, DCX and MIC uploads at the edge in addition to EPS.

Update 2026-10-27 — a sixth id, a denial of service: CVE-2026-96638 (BMP RLE decoder memory amplification), Pillow 9.1.0 before 13.0.0, CVSS 3.1 6.5

CVE-2026-96638 / GHSA-24rc-8hj2-v98c (CNA GitHub, published 2026-10-21; it surfaced today on the advisory database's cursor listing, which matches description text): BmpRleDecoder.decode() let crafted delta escapes and absolute-mode runs append beyond the remaining destination length with no per-branch cap, so a kilobyte-sized BMP with a large permitted width expands the data buffer to hundreds of megabytes, a memory-exhaustion denial of service (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Affected 9.1.0 up to but not including 13.0.0; fixed 13.0.0 (PR #10015). Same action as the five above; if 13.0.0 is still pending, add BMP to the edge reject list for untrusted uploads.

Sources