Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

Pillow, Python's go-to imaging library with roughly 436 million monthly downloads according to OX Security, has shipped version 13.0.0 to close several serious security holes. The headline issue, CVE-2026-112900, stems from how Pillow hands EPS filenames off to Ghostscript without validation—letting an attacker who controls a file's name trick Ghostscript into executing commands from a second, attacker-supplied file, even though the EPS content itself is harmless. GitHub's CVE scoring rates this 9.2/10, though Pillow's maintainers call it only moderate since it requires attacker control over the filename, and no active exploitation has been observed; it affects versions 2.6.0 through 12.3.0 and only matters where the gs binary is installed.

The same release also fixes two bugs the maintainers themselves label critical: a stale-memory issue triggered by image mode changes, and a pair of JPEG-decoding overflows. One of those, tied to FlashPix (FPX) files detected by content rather than extension, was demonstrated to achieve command execution from a single Image.open() call when the optional olefile package is present. The other, CVE-2026-112403, causes a buffer overflow when thumbnailing a crafted lossless JPEG and was partly uncovered using Anthropic's Claude as part of an AI-assisted open-source bug-hunting effort. A fourth bug, CVE-2026-112393, is a decade-old TIFF-saving overflow that chains with a separate memory-leak flaw to become exploitable when images are saved to an in-memory buffer rather than disk; a public proof of concept exists for this one. Anyone running Pillow should upgrade to 13.0.0 (which also drops Python 3.10 support) and rebuild affected containers or wheels, while applying mitigations like avoiding untrusted EPS filenames, calling load() before thumbnailing, and treating in-memory TIFF saves as risky until patched.