Threat reportVulnerabilityTL-2026-4308
Critical Pillow Image Library Flaws Enable Code Execution via Crafted Image (CVE-2026-112900, CVE-2026-112393, CVE-2026-112403, CVE-2026-112398)
Critical Pillow Image Library Flaws Enable Code Execution (TL-2026-4308) is a critical-severity software vulnerability scored CVSS 9.2, first published 2026-10-23. It has no confirmed attribution, affects Python Pillow Pillow (PyPI), references 4 CVEs (CVE-2026-112900, CVE-2026-112393, CVE-2026-112403), maps to 5 MITRE ATT&CK techniques (T1036.008, T1059, T1190), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 9.2/10Critical
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-4308
- Threat ID
- TL-2026-4308
- Severity
- CRITICAL
- CVSS
- 9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, cloud-services, news - media, ecommerce
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in Critical Pillow Image Library Flaws Enable Code Execution
Malware and tooling: Python, ghostscript (gs), libjpeg-turbo >= 3.0
How Critical Pillow Image Library Flaws Enable Code Execution works
Multiple critical memory-safety and injection flaws in Python's Pillow imaging library (up to 12.3.0) allow code execution or process crashes from crafted images or filenames: Ghostscript argument injection via EPS filenames (CVE-2026-112900), a TIFF in-memory write heap overflow (CVE-2026-112393), a lossless-JPEG draft/thumbnail heap overflow (CVE-2026-112403) and an FPX JPEG-tile heap overflow (CVE-2026-112398). All are fixed in Pillow 13.0.0 (2026-10-16); no active exploitation has been reported.
Pillow is among the most widely deployed Python packages (~436 million monthly downloads per reporting) and is routinely used to process untrusted user uploads. Pillow 13.0.0, released 2026-10-16, fixes 41 security issues; this record covers the four critical ones highlighted by The Hacker News, OX Security and the GitHub Security Advisories.
CVE-2026-112900 (EPS / Ghostscript argument injection, CWE-78/CWE-88): PIL.EpsImagePlugin.Ghostscript() passes the input file path to the gs command line without normalizing it. A filename beginning with '-' is parsed by Ghostscript as an option, and a filename beginning with '@' is treated as an argument file (@argfile), allowing injection of arbitrary Ghostscript arguments even under default -dSAFER. The trigger is the filename, not the content of the PostScript document, so the attacker must control the filename passed to Image.open() and Ghostscript (gs) must be installed. Affects Pillow 2.6.0 through 12.3.0. NVD scores it CVSS 4.0 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H). Reported by Chanu Kang (CysecLab, KAIST) per the GitHub advisory; OX Security also published research on the flaw.
CVE-2026-112393 (TIFF write heap overflow, CWE-122): when saving compressed TIFF to a file-like object without an OS file descriptor (e.g. io.BytesIO), the _tiffWriteProc memory sink sizes reallocation from state->size instead of state->loc. When libtiff seeks past the end of written data, the first out-of-line tag value is written beyond the allocated buffer, enabling attacker-chosen data to be written past heap bounds and stale heap bytes to leak into the saved file. The defect dates to a 2013 commit (e782fe7) and affects Pillow 2.0.0 through 12.3.0. Services that re-encode uploaded images as TIFF in memory are exposed. The advisory (reporters carlini and Tomer-PL) includes a Python reproducer; reporting credits Anthropic (using Claude) with Ada Logics validation. Saving TIFF to a real file path is unaffected and is a workaround.
CVE-2026-112403 (JPEG draft/thumbnail heap overflow, CWE-122): ImagingJpegDecode() requests scaled decoding (via Image.thumbnail() implicitly calling draft()) but never compares libjpeg's actual output geometry with the allocated buffer. With 8-bit lossless (SOF3) JPEGs, libjpeg-turbo 3.x ignores the scaling request and writes full-width scanlines into a scaled-width buffer. Reproduction needs libjpeg-turbo >= 3.0 and images of at least 1024x1024. Affects Pillow <= 12.3.0. Credited to Claude (Anthropic) as discoverer, validated by Ada Logics, reported by DavidKorczynski. Workarounds: call img.load() before thumbnail(), use thumbnail(..., reducing_gap=None), or use resize().
CVE-2026-112398 (FPX JPEG-tile heap overflow, CWE-122/CWE-787): in the FlashPix decoder an unrecognized rawmode triggers a fallback where libjpeg runs in JCS_UNKNOWN mode and outputs 4 bytes per pixel, exceeding the allocated buffer. The advisory describes the out-of-bounds write overwriting an adjacent Python bytes object's ob_type with a pointer to a fake PyTypeObject, giving arbitrary code execution from a single Image.open() call. Requires the optional olefile package; Pillow identifies formats by content rather than extension, so blind uploads with any extension can reach the FPX parser. Reported by Alex Bouffard (pebwalker). Note: the hunt skeleton's CVE-to-flaw mapping was ambiguous; the GitHub advisory GHSA-5x8w-8jj5-q52h lists this flaw as CVE-2026-112398.
Exploitation status: no known in-the-wild exploitation was reported for any of these flaws. A public reproducer exists in the TIFF advisory. Remediation is upgrading to Pillow 13.0.0 (requires Python 3.11+; Python 3.10 support dropped), rebuilding containers and wheels that bundle older Pillow, removing Ghostscript from hosts handling untrusted uploads, and never passing attacker-controlled filenames to Image.open().
MITRE ATT&CK techniques used in TL-2026-4308
Defense Evasion
T1036.008 Masquerade File Type
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Initial Access
T1190 Exploit Public-Facing Application
Impact
Affected products and versions in Critical Pillow Image Library Flaws Enable Code Execution
- Python Pillow — Pillow (PyPI)
Vulnerable versions: 2.6.0 through 12.3.0 (CVE-2026-112900, EPS); 2.0.0 through 12.3.0 (CVE-2026-112393, TIFF); <= 12.3.0 (CVE-2026-112403, JPEG thumbnail; requires libjpeg-turbo >= 3.0); <= 12.3.0 (CVE-2026-112398, FPX; requires olefile)
Fixed in: 13.0.0
Remediation for Critical Pillow Image Library Flaws Enable Code Execution
Patches
- Pillow 13.0.0 (released 2026-10-16) fixes CVE-2026-112900, CVE-2026-112393, CVE-2026-112403 and CVE-2026-112398
Immediate actions
- Upgrade to Pillow 13.0.0 or later: pip install -U "Pillow>=13.0.0"
- Rebuild containers, wheels and virtualenvs that bundle older Pillow versions
- Remove Ghostscript (gs) from hosts that process untrusted uploads
- Never pass attacker-controlled filenames to Image.open(); normalize with os.path.abspath() if upgrade is delayed
Workarounds
- TIFF (CVE-2026-112393): save TIFF to a real file path instead of an in-memory buffer such as io.BytesIO
- JPEG (CVE-2026-112403): call img.load() before thumbnail(), use thumbnail(..., reducing_gap=None), or use resize() instead of thumbnail()/draft() on untrusted JPEGs
- FPX (CVE-2026-112398): uninstall the optional olefile package where FPX support is not needed
- EPS (CVE-2026-112900): uninstall Ghostscript or do not process untrusted EPS files or filenames
Longer-term hardening
- Restrict accepted image formats on upload endpoints (reject EPS, FPX, TIFF if not required)
- Process untrusted images in sandboxed, least-privilege workers
- Inventory transitive Pillow dependencies via SBOM and monitor for vulnerable versions
- Plan migration to Python 3.11+ since Pillow 13 drops Python 3.10
CVEs associated with Critical Pillow Image Library Flaws Enable Code Execution
CVE-2026-112900, CVE-2026-112393, CVE-2026-112403, CVE-2026-112398
Weaknesses (CWE) in Critical Pillow Image Library Flaws Enable Code Execution
Timeline of Critical Pillow Image Library Flaws Enable Code Execution
- Pillow 13.0.0 released, fixing 41 security issues including the four critical flaws; drops Python 3.10 support
- GitHub Security Advisories published for the EPS/Ghostscript, TIFF, JPEG thumbnail and FPX flaws in python-pillow/Pillow
- NVD published CVE-2026-112900 with CVSS 4.0 score 9.2 (CRITICAL); OX Security lists this as its disclosure date
- Pillow vulnerabilities discussed on the oss-security mailing list
- OX Security published technical analysis of three critical Pillow CVEs
- The Hacker News reported the flaws; no known in-the-wild exploitation, public reproducer available for the TIFF flaw
Sources cited for Critical Pillow Image Library Flaws Enable Code Execution
- Critical Flaw in Python's Popular Pillow Image Library Allows Code Execution via a Crafted Image
- OX Security: Three Critical Pillow CVEs
- Pillow 13.0.0 Release Notes
- GitHub Security Advisory - EPS/Ghostscript (CVE-2026-112900)
- GitHub Security Advisory - FlashPix FPX (CVE-2026-112398)
- GitHub Security Advisory - JPEG Thumbnail (CVE-2026-112403)
- GitHub Security Advisory - TIFF (CVE-2026-112393)
- NVD - CVE-2026-112900
- Pillow fix commit for CVE-2026-112900
- Pillow 13.0.0 GitHub release
- Ubuntu USN-8399-1: Pillow vulnerabilities
- Debian DSA-6357-1
- oss-security post on Pillow
Detection coverage for TL-2026-4308
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4308 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.