Pillow 13.0.0 closes 39 more flaws, two of them rated critical

Pillow 13.0.0 closes 39 more flaws, two of them rated critical

17 October 2026: Pillow, the imaging library behind most Python code that opens, resizes or thumbnails a picture, published 39 further security advisories on 17 October, all fixed in version 13.0.0. Two are rated critical, including CVE-2026-112398, a heap overflow in the FlashPix decoder that its finder turned into command execution by getting an application to open one crafted file. A 40th advisory, posted two days later, has no fix yet.

Beyond the OpenJPEG wheel problem

When 13.0.0 shipped on 16 October we reported the heap overflow in the OpenJPEG copy bundled in Pillow's wheels, which a system update cannot fix. The advisories published the next day show that was one item in a much larger clean-up of Pillow's own C decoders and Python plugins. By the maintainers' labels the other 39 hold 2 critical, 12 high, 22 medium and 3 low entries. Most affect every release up to 12.3.0; a few start later, such as the APNG and PNG eXIf issues.

The two critical flaws

CVE-2026-112398 sits in FpxImagePlugin. Pillow recognises a FlashPix file by its OLE2 signature rather than its extension, so any service that opens untrusted uploads with the optional olefile package installed can be reached with no user interaction. The researcher, Alex Bouffard, demonstrated an attacker-chosen command on stock Pillow 12.2.0 on Ubuntu 24.04.

CVE-2026-96639, scored 9.8, affects multi-frame loaders from 11.0.0. If the first frame of an image allocates storage for a narrow mode and a later frame of the same size switches to a wider one such as RGB or CMYK, Pillow can decode the wider pixels into the old buffer. The advisory reports command execution through the documented ImageSequence.Iterator path on MPO and JPEG files.

Where the rest cluster

TIFF handling accounts for the largest group: heap overflows when saving TIFF to an in-memory buffer (CVE-2026-112393), out-of-bounds reads that leak heap memory into pixel data (CVE-2026-112404, CVE-2026-112896) and a use-after-free in the encoder (CVE-2026-112396). JPEG decoding has CVE-2026-112403, where the library trusts its own guess of output geometry instead of libjpeg's. PDF and GIF parsing contribute a run of infinite loops, unbounded recursion and quadratic-time slowdowns that let a small file tie up a worker for minutes.

CVE-2026-112900 is the odd one out: PIL.EpsImagePlugin passes the file name to Ghostscript without guarding it, so a name that begins with a hyphen is read as a Ghostscript option. It is rated medium because the attacker must control the file name and Ghostscript must be installed.

Upgrading, and the one still open

Version 13.0.0 drops Python 3.10, so services pinned to 3.10 need a runtime upgrade first or stay exposed. CVE-2026-114501 affects 11.2.1 through 13.0.0 and has no patched release: with PILLOW_ALIGNMENT set above 1, exporting an image to Arrow returns uninitialised heap memory, which can include pixels from images processed earlier. Leaving that variable unset avoids it until a fix ships.

Sources

• Pillow on GitHub: security advisories, 17 October 2026
• Pillow: GHSA-5x8w-8jj5-q52h, heap buffer overflow in FlashPix JPEG decoding (CVE-2026-112398), 17 October 2026
• Pillow: GHSA-v9pv-5gc8-w2m6, stale native storage in multi-frame loaders (CVE-2026-96639), 17 October 2026
• Pillow: GHSA-654x-cwwv-5j9c, Arrow export leaks stale heap memory (CVE-2026-114501), 19 October 2026
• Pillow 13.0.0 release on GitHub, 16 October 2026