# Critical Pillow Image Library Flaws Enable Code Execution via Crafted Image (CVE-2026-112900, CVE-2026-112393, CVE-2026-112403, CVE-2026-112398)

> Multiple critical memory-safety and injection flaws in Python's Pillow imaging library (up to 12.3.0) allow code execution or process crashes from crafted images or filenames: Ghostscript argument injection via EPS filenames (CVE-2026-112900), a TIFF in-memory write heap overflow (CVE-2026-112393), a lossless-JPEG draft/thumbnail heap overflow (CVE-2026-112403) and an FPX JPEG-tile heap overflow (CVE-2026-112398). All are fixed in Pillow 13.0.0 (2026-10-16); no active exploitation has been reported.

- **Published:** 2026-10-23T20:20:28Z
- **Last reviewed:** 2026-10-23T20:20:28Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4308
- **ID:** TL-2026-4308
- **Severity:** CRITICAL (CVSS 9.2)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-112900, CVE-2026-112393, CVE-2026-112403, CVE-2026-112398

## Description

Pillow is among the most widely deployed Python packages (~436 million monthly downloads per reporting) and is routinely used to process untrusted user uploads. Pillow 13.0.0, released 2026-10-16, fixes 41 security issues; this record covers the four critical ones highlighted by The Hacker News, OX Security and the GitHub Security Advisories.

CVE-2026-112900 (EPS / Ghostscript argument injection, CWE-78/CWE-88): PIL.EpsImagePlugin.Ghostscript() passes the input file path to the gs command line without normalizing it. A filename beginning with '-' is parsed by Ghostscript as an option, and a filename beginning with '@' is treated as an argument file (@argfile), allowing injection of arbitrary Ghostscript arguments even under default -dSAFER. The trigger is the filename, not the content of the PostScript document, so the attacker must control the filename passed to Image.open() and Ghostscript (gs) must be installed. Affects Pillow 2.6.0 through 12.3.0. NVD scores it CVSS 4.0 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H). Reported by Chanu Kang (CysecLab, KAIST) per the GitHub advisory; OX Security also published research on the flaw.

CVE-2026-112393 (TIFF write heap overflow, CWE-122): when saving compressed TIFF to a file-like object without an OS file descriptor (e.g. io.BytesIO), the _tiffWriteProc memory sink sizes reallocation from state->size instead of state->loc. When libtiff seeks past the end of written data, the first out-of-line tag value is written beyond the allocated buffer, enabling attacker-chosen data to be written past heap bounds and stale heap bytes to leak into the saved file. The defect dates to a 2013 commit (e782fe7) and affects Pillow 2.0.0 through 12.3.0. Services that re-encode uploaded images as TIFF in memory are exposed. The advisory (reporters carlini and Tomer-PL) includes a Python reproducer; reporting credits Anthropic (using Claude) with Ada Logics validation. Saving TIFF to a real file path is unaffected and is a workaround.

CVE-2026-112403 (JPEG draft/thumbnail heap overflow, CWE-122): ImagingJpegDecode() requests scaled decoding (via Image.thumbnail() implicitly calling draft()) but never compares libjpeg's actual output geometry with the allocated buffer. With 8-bit lossless (SOF3) JPEGs, libjpeg-turbo 3.x ignores the scaling request and writes full-width scanlines into a scaled-width buffer. Reproduction needs libjpeg-turbo >= 3.0 and images of at least 1024x1024. Affects Pillow <= 12.3.0. Credited to Claude (Anthropic) as discoverer, validated by Ada Logics, reported by DavidKorczynski. Workarounds: call img.load() before thumbnail(), use thumbnail(..., reducing_gap=None), or use resize().

CVE-2026-112398 (FPX JPEG-tile heap overflow, CWE-122/CWE-787): in the FlashPix decoder an unrecognized rawmode triggers a fallback where libjpeg runs in JCS_UNKNOWN mode and outputs 4 bytes per pixel, exceeding the allocated buffer. The advisory describes the out-of-bounds write overwriting an adjacent Python bytes object's ob_type with a pointer to a fake PyTypeObject, giving arbitrary code execution from a single Image.open() call. Requires the optional olefile package; Pillow identifies formats by content rather than extension, so blind uploads with any extension can reach the FPX parser. Reported by Alex Bouffard (pebwalker). Note: the hunt skeleton's CVE-to-flaw mapping was ambiguous; the GitHub advisory GHSA-5x8w-8jj5-q52h lists this flaw as CVE-2026-112398.

Exploitation status: no known in-the-wild exploitation was reported for any of these flaws. A public reproducer exists in the TIFF advisory. Remediation is upgrading to Pillow 13.0.0 (requires Python 3.11+; Python 3.10 support dropped), rebuilding containers and wheels that bundle older Pillow, removing Ghostscript from hosts handling untrusted uploads, and never passing attacker-controlled filenames to Image.open().

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1036.008 Masquerade File Type
- T1499.004 Application or System Exploitation

## Sources

- [Critical Flaw in Python's Popular Pillow Image Library Allows Code Execution via a Crafted Image](https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html)
- [OX Security: Three Critical Pillow CVEs](https://www.ox.security/blog/three-critical-pillow-cves-rce-and-heap-overflows-in-pythons-imaging-library-cve-2026-112900-cve-2026-112393-cve-2026-112403/)
- [Pillow 13.0.0 Release Notes](https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html)
- [GitHub Security Advisory - EPS/Ghostscript (CVE-2026-112900)](https://github.com/python-pillow/Pillow/security/advisories/GHSA-w889-685w-c8fh)
- [GitHub Security Advisory - FlashPix FPX (CVE-2026-112398)](https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x8w-8jj5-q52h)
- [GitHub Security Advisory - JPEG Thumbnail (CVE-2026-112403)](https://github.com/python-pillow/Pillow/security/advisories/GHSA-8g5g-8vmr-9782)
- [GitHub Security Advisory - TIFF (CVE-2026-112393)](https://github.com/python-pillow/Pillow/security/advisories/GHSA-332p-7hrc-92wf)
- [NVD - CVE-2026-112900](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-112900)
- [Pillow fix commit for CVE-2026-112900](https://github.com/python-pillow/Pillow/commit/a2c363141da31a265dd536c945677db4b64f3ec9)
- [Pillow 13.0.0 GitHub release](https://github.com/python-pillow/Pillow/releases/tag/13.0.0)
- [Ubuntu USN-8399-1: Pillow vulnerabilities](https://ubuntu.com/security/notices/USN-8399-1)
- [Debian DSA-6357-1](https://security-tracker.debian.org/tracker/DSA-6357-1)
- [oss-security post on Pillow](https://openwall.com/lists/oss-security/2026/10/21/24)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4308