---
id: 2026-10-pillow-13-0-0-ghostscript-argument-injection-jpeg-heap-overflow-cve-2026-112900-112403-112393
title: "Pillow before 13.0.0: Ghostscript argument injection from a filename (CVE-2026-112900, 9.2) and two heap overflows (CVE-2026-112403, CVE-2026-112393); upgrade to 13.0.0"
date_disclosed: 2026-10-17
last_updated: 2026-10-27
severity: high
status: patched
ecosystems: [python, pypi, fastapi, django, streamlit, image-processing]
tools_affected: ["Pillow 2.6.0 before 13.0.0 (CVE-2026-112900, EPS input with Ghostscript installed)", "Pillow before 13.0.0 built against libjpeg-turbo 3.x, which the official wheels bundle (CVE-2026-112403, thumbnail() path)", "Pillow before 13.0.0 (CVE-2026-112393, TIFF save to BytesIO)", "any FastAPI, Django, Flask or Streamlit app that opens uploaded images, and any agent tool that does"]
tags: [cve, ghsa, pillow, python, argument-injection, ghostscript, heap-overflow, jpeg, tiff, image-upload, rce, ai-found, anthropic, ada-logics, db-date-lag]
---

## TL;DR
Pillow 13.0.0 fixes three advisories the GitHub Advisory Database rates critical, all published on the vendor tab on 2026-10-17 and listed in the database on 10-20 and 10-21. CVE-2026-112900 (GHSA-w889-685w-c8fh, CVSS 4.0 9.2): `EpsImagePlugin.Ghostscript` passes the input file's name to Ghostscript after `-f` without making it a safe absolute path, so a filename beginning with `-` becomes a Ghostscript option and one beginning with `@` pulls arguments from a file; the reporter verified command execution with `-dSAFER` in place, and the trigger is the filename, not the EPS content, so upload handlers that keep user-supplied names are the exposed shape. CVE-2026-112403 (GHSA-8g5g-8vmr-9782, 9.2): `thumbnail()` requests a reduced-scale JPEG decode and sizes its row buffer for it, libjpeg-turbo 3.x ignores the request for lossless SOF3 files, and full-width rows overflow the buffer; the official wheels bundle libjpeg-turbo 3, and this one was found by Anthropic using Claude and validated by Ada Logics. CVE-2026-112393 (GHSA-332p-7hrc-92wf): a heap overflow in `_tiffWriteProc` when saving TIFF to `BytesIO`. The vendor tab holds a further page of 2026-10-17 advisories at moderate and low. This file rates the set `high`: the 9.2s are the CNA's, and each needs a precondition (Ghostscript installed and an attacker-chosen filename; the `draft()` path with a large lossless JPEG).

## What happened

**CVE-2026-112900.** GitHub CNA, published 2026-10-19; affected 2.6.0 through 12.x, patched 13.0.0. Mechanism per the advisory: `PIL.EpsImagePlugin.Ghostscript()` passes `fp.name` unvalidated as the `-f` argument. `-`-prefixed names are parsed as options; `@`-prefixed names are argument-file references that can inject several arguments, and for code execution the attacker also controls the referenced text file. Verified on Ghostscript 10.02.1 and reported to work on 10.07.1. CWE-88, CWE-78; vector `AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H`. No workaround is listed; the fix commit is a2c3631. Reporter Chanu Kang (CysecLab, KAIST); remediation radarhere, review hugovk.

**CVE-2026-112403.** GitHub CNA, published 2026-10-19; affected up to 12.3.0, patched 13.0.0. `ImagingJpegDecode` does not verify libjpeg's actual output width and component count after scaling is requested; with libjpeg-turbo 3.0 or later a lossless 8-bit SOF3 JPEG keeps full width and writes past a buffer sized for the draft scale. Reached through `Image.thumbnail()`, which calls `draft()`; `open().load()` and `resize()` are not affected; builds on libjpeg-turbo 2.x or IJG libjpeg reject the files first. The advisory says an image of at least 1024 pixels per side thumbnailed to 256×256 with defaults triggers it. Workarounds: call `load()` before `thumbnail()`, or pass `reducing_gap=None`. Vector `AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H`, CWE-122; fix commit 242a059. Found by Anthropic using Claude, validated manually by Ada Logics; reporter DavidKorczynski.

**CVE-2026-112393.** Listed by the database on 2026-10-21 as "Heap buffer overflow in `_tiffWriteProc` when saving TIFF to BytesIO," Critical, Pillow; this sweep read the listing row and not the advisory page, so no range beyond "before 13.0.0" and no vector is stated here.

**The rest of the tab.** Page one of seven (read 2026-10-22) holds ten more advisories dated 2026-10-17 and 10-19 without CVE ids: a bundled `libopenjp2` 2.5.4 heap overflow reachable from `Image.open().load()` (High), several quadratic or infinite-loop denials of service in GIF, PDF and XBM handling, an Arrow-export heap leak, an EPS decompression-bomb bypass, and a NULL dereference. Pages two to seven were not walked.

**Registry.** `pip index versions pillow`, read 2026-10-22: 13.0.0 is the newest.

Why it is here: Pillow is the image library under FastAPI and Django upload handlers, Streamlit apps and most Python agent tools that look at a picture, and the Ghostscript bug is reachable from the one field those handlers least often sanitise, the filename.

## Am I affected?

- `pip show pillow`; anything below 13.0.0.
- For CVE-2026-112900: Ghostscript installed on the host (`gs --version`), EPS accepted or sniffed as input, and a code path where a user-chosen filename reaches `Image.open()` or `EpsImagePlugin`. Saving uploads under their original names and opening them by path is the exposed pattern.
- For CVE-2026-112403: `thumbnail()` on untrusted JPEGs with the official wheels (libjpeg-turbo 3). `PIL.features.version("jpg")` shows the bundled version.

## If you are affected

1. `pip install -U "pillow>=13.0.0"`, rebuild images, redeploy.
2. Until then: never pass a user-supplied name to Ghostscript paths, store uploads under generated names, and call `load()` before `thumbnail()` or pass `reducing_gap=None`.
3. A host that processed attacker-chosen EPS filenames with Ghostscript present while unpatched should be treated as possibly compromised: [if your webapp was compromised](../playbooks/if-your-webapp-was-compromised.md), then [rotating cloud credentials](../playbooks/rotating-cloud-credentials.md).

## Prevention

- [Agent sandboxing](../prevention/agent-sandboxing.md): image parsing of untrusted input belongs in a worker with no credentials and no Ghostscript unless needed.
- [Credential hygiene](../prevention/credential-hygiene.md).

## Update 2026-10-26 — two more Critical Pillow records, both fixed in the same 13.0.0

- **CVE-2026-112398 / GHSA-5x8w-8jj5-q52h** (database 10-23, CVSS 9.2): heap overflow decoding JPEG data embedded in FlashPix (FPX) containers, Pillow through 12.3.0, fixed 13.0.0; reachable only when `olefile` is installed, which most image-upload stacks do not have; credit Alex Bouffard.
- **CVE-2026-96639 / GHSA-v9pv-5gc8-w2m6** (database 10-22, CVSS 9.8): stale image storage reused across frames in multi-frame formats (PSD, MPO, DCX, MIC), Pillow 11.0.0 up to but not including 13.0.0, fixed 13.0.0 (PR #10105); credit Rotem Kama.

Nothing changes in the action: 13.0.0 is the fix for all six ids now in this file (the sixth, a BMP denial of service, was added on 10-27 below). If 13.0.0 cannot be taken yet, reject FPX, PSD, MPO, DCX and MIC uploads at the edge in addition to EPS.

## Update 2026-10-27 — a sixth id, a denial of service: CVE-2026-96638 (BMP RLE decoder memory amplification), Pillow 9.1.0 before 13.0.0, CVSS 3.1 6.5

CVE-2026-96638 / GHSA-24rc-8hj2-v98c (CNA GitHub, published 2026-10-21; it surfaced today on the advisory database's `cursor` listing, which matches description text): `BmpRleDecoder.decode()` let crafted delta escapes and absolute-mode runs append beyond the remaining destination length with no per-branch cap, so a kilobyte-sized BMP with a large permitted width expands the data buffer to hundreds of megabytes, a memory-exhaustion denial of service (`AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H`). Affected 9.1.0 up to but not including 13.0.0; fixed 13.0.0 (PR #10015). Same action as the five above; if 13.0.0 is still pending, add BMP to the edge reject list for untrusted uploads.

## Sources
- [python-pillow/Pillow — GHSA-w889-685w-c8fh: Argument Injection in Ghostscript call, potentially leading into RCE](https://github.com/advisories/GHSA-w889-685w-c8fh) — fetched 2026-10-22: CVE-2026-112900, 9.2 and vector, the range, the `-` and `@` mechanism, the `-dSAFER` statement, the preconditions, published 2026-10-17 on GitHub and 2026-10-19 on NVD, credits, commit a2c3631.
- [python-pillow/Pillow — GHSA-8g5g-8vmr-9782: Heap buffer overflow in ImagingJpegDecode](https://github.com/advisories/GHSA-8g5g-8vmr-9782) — fetched 2026-10-22: CVE-2026-112403, 9.2 and vector, the `draft()` mechanism, the libjpeg-turbo 3 precondition, the not-affected paths, the two workarounds, the Anthropic and Ada Logics credit, commit 242a059.
- [CVE Services — CVE-2026-112900](https://cveawg.mitre.org/api/cve/CVE-2026-112900) and [CVE-2026-112403](https://cveawg.mitre.org/api/cve/CVE-2026-112403) — fetched 2026-10-22: GitHub CNA, published 2026-10-19, ranges, 9.2.
- [GitHub Advisory Database — reviewed critical pip listing](https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip+severity%3Acritical+sort%3Apublished-desc) — fetched 2026-10-22: GHSA-332p-7hrc-92wf (CVE-2026-112393) and GHSA-w889-685w-c8fh dated 2026-10-21, GHSA-8g5g-8vmr-9782 dated 2026-10-20.
- [python-pillow/Pillow — security advisories tab](https://github.com/python-pillow/Pillow/security/advisories) — fetched 2026-10-22: page one of seven, the ten rows summarised above.
- `pip index versions pillow` — read 2026-10-22: 13.0.0.
- **2026-10-26 update sources** — [GitHub Advisory Database — GHSA-5x8w-8jj5-q52h](https://github.com/advisories/GHSA-5x8w-8jj5-q52h) — fetched 2026-10-26: CVE-2026-112398, 9.2, `<= 12.3.0`, patched 13.0.0, the olefile condition, credit.
- [GitHub Advisory Database — GHSA-v9pv-5gc8-w2m6](https://github.com/advisories/GHSA-v9pv-5gc8-w2m6) — fetched 2026-10-26: CVE-2026-96639, 9.8, `>= 11.0.0, < 13.0.0`, patched 13.0.0, the format list, PR #10105, credit.
- **2026-10-27 update source** — [CVE Services — CVE-2026-96638](https://cveawg.mitre.org/api/cve/CVE-2026-96638) (queried 2026-10-27: CNA GitHub_M, published 2026-10-21, Pillow >= 9.1.0 < 13.0.0, the description, CVSS 3.1 6.5, GHSA-24rc-8hj2-v98c, PR #10015, commit e7794835, release 13.0.0).