Pillow 13.0.0 fixes heap overflow in its bundled OpenJPEG

Pillow 13.0.0 fixes heap overflow in its bundled OpenJPEG

17 October 2026: Pillow, the standard Python imaging library, has published a high-severity advisory (GHSA-78g4-xqwv-q3g8) for a heap buffer overflow in the copy of OpenJPEG bundled in every wheel from 11.1.0 to 12.3.0. One crafted JPEG 2000 file opened with Image.open() and load() under default settings triggers it, and the patched release is Pillow 13.0.0.

Not yet independently verified. The advisory carries no CVE identifier, and we could not confirm whether a separately reported critical Pillow flaw, CVE-2026-112900, is the same issue or a different one. We will update this when it can be confirmed, and remove this note.

Why a patched server is still exposed

Pillow's wheels on PyPI carry their own libopenjp2 rather than linking the system library, so updating OpenJPEG through the operating system changes nothing for an application that installed Pillow with pip. The affected builds are:

Pillow wheels	Bundled libopenjp2
11.1.0 to 11.3.0	2.5.3
12.0.0 to 12.3.0	2.5.4
13.0.0	patched release

The flaw, tracked as OSV-2025-219, is a missing bounds check in opj_j2k_read_sod. It entered OpenJPEG in a June 2024 commit, so 2.5.2 and earlier are safe, and the upstream fix has sat on OpenJPEG's main branch since February 2026 without appearing in a release. Keeping the dependency current is, unusually, what created the exposure.

How bad one file can be

The advisory reports that on a stock wheel the overflow writes some 5.8 KB past a 24-byte allocation and glibc aborts the process, so one upload reliably kills a long-lived worker. It also shows the write crossing a structure that holds function pointers, which gives an attacker a way towards code execution, demonstrated as a building block rather than a finished exploit. The cases that matter are upload handlers, thumbnail generators and document preview pipelines: anything that opens images it did not produce.

Upgrading, and narrowing what Pillow will open

The fix is Pillow 13.0.0, released on 16 October. It drops support for Python 3.10, so services still on 3.10 cannot take it and need another route. For them, and as a general hardening step, Image.open() accepts a formats argument: passing only the formats an application expects, for example JPEG and PNG, stops it reaching the JPEG 2000 decoder at all, because Pillow otherwise ignores file names and content types and tries every compiled-in codec.

Pillow's advisory list shows further advisories published between 17 and 19 October, most of them moderate or low-severity denial-of-service issues in GIF, XBM and PDF handling, so the 13.0.0 upgrade closes more than this one flaw.

Sources

• GitHub Security Advisory GHSA-78g4-xqwv-q3g8: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219, 17 October 2026
• Pillow releases on GitHub: 13.0.0, 16 October 2026
• Pillow security advisories on GitHub (read 2026-10-23), 23 October 2026