/
← Voltar ao feed
high technology

Pillow 13.0.0 fixes critical flaws incl. EPS/Ghostscript command execution (CVE-2026-112900), JPEG and TIFF memory bugs

1 fonte(s) · 1 atualização(ões) · publicado 23/10/2026 06:36 · coletado há 6 horas

Pillow, the most widely used Python image library (about 436 million downloads a month, per OX Security), shipped version 13.0.0 on October 16 with a large security release. It fixes flaws across all severity levels, two of them rated critical by the maintainers. The headline issue, CVE-2026-112900, lets an attacker who controls the filename of an EPS file run OS commands through Ghostscript. None of the flaws is known to be exploited. Upload endpoints that build stored filenames from user input are the realistic target.

Entenda a falha

A vulnerabilidade

Pillow 13.0.0 fixes several flaws. The headline one, CVE-2026-112900, is in EPS handling: Pillow passes the filename to Ghostscript (gs) without validation, so an attacker who controls the filename can get OS commands run. It affects Pillow 2.6.0 through 12.3.0, only on hosts with gs installed. The maintainers rate it moderate, but the GitHub-assigned CVE scores it 9.2. CVE-2026-112403 is a buffer overflow when making a thumbnail of a crafted lossless JPEG (crash only, per the advisory, 9.2). CVE-2026-112393 is a buffer overflow, present since 2013, when saving a compressed TIFF to memory (9.2). An FPX JPEG overflow was shown to run a command from one Image.open() call when olefile is installed, and a separate critical bug reuses stale image data after a mode change. Fixed in 13.0.0.

Como funciona

For EPS, an application calls Image.open() on an EPS file. Pillow hands the filename to the separate gs program to render the image. Ghostscript can read a name chosen by an attacker as instructions instead of as a file and point to a second file carrying commands, so the step that fails is passing the unchecked name along. The content of the PostScript is irrelevant. For the TIFF bug, a service re-encodes an upload and saves a compressed TIFF to an in-memory buffer such as io.BytesIO, and the write overflows a memory buffer. For the JPEG thumbnail bug, draft() or thumbnail() on a crafted lossless JPEG overflows a buffer during decoding.

Por que é vulnerável

The EPS flaw is a missing input check: Pillow trusts the filename and passes it to an external program that gives certain names special meaning. The JPEG and TIFF flaws are memory-safety bugs, buffer overflows in decoding and encoding code, and the TIFF one went unnoticed in Pillow since 2013. The articles do not describe the exact code-level fixes beyond saying that 13.0.0 resolves all of these.

Como foi descoberta

CVE-2026-112403 was found by Anthropic using Claude to study the security of open-source software and validated manually by Ada Logics, per the advisory. The TIFF reporters crashed the process and reached code execution only by chaining a second, separate flaw that leaks memory addresses. OX Security's report drew attention to the flaws. The fixes shipped as an advisory-backed release, Pillow 13.0.0, on October 16, with CVE records assigned by GitHub. None of the flaws is known to be exploited in the wild.

PoC pública

The CVE record for CVE-2026-112393 (TIFF), per CISA analysts, notes a public proof of concept, but the articles give no link, author or detail. The advisory says the reporters only crashed the process, and reached code execution by chaining a second memory-leak flaw. The FPX JPEG overflow was also shown to run a command from a single Image.open() call, but no public exploit is cited for it. Treat the TIFF path as higher urgency for services that save user images to memory buffers, and patch anyway.

Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 08:16.

Detalhes técnicos

  • CVE-2026-112900: Pillow passes the EPS filename to Ghostscript (gs) without validation. Ghostscript can interpret an attacker-chosen name as instructions and point to a second file carrying commands. It affects Pillow 2.6.0 through 12.3.0 and only hosts with gs installed. The trigger is the filename, not the PostScript content. The maintainers rate it moderate, while the GitHub-assigned CVE record scores it 9.2/10. CISA analysts mark no known exploitation.
  • FlashPix (FPX) JPEG overflow: demonstrated to run an attacker's command from a single Image.open() call on a crafted file when the optional olefile package is installed. Pillow identifies files by content, not extension, so servers opening untrusted uploads can be hit with no user action.
  • CVE-2026-112403: buffer overflow when creating a thumbnail of a crafted lossless JPEG. The advisory reports a crash, not code execution. It was found by Anthropic using Claude and validated manually by Ada Logics. Scored 9.2/10.
  • CVE-2026-112393: buffer overflow, present since 2013, when saving a compressed TIFF to memory (e.g. io.BytesIO). Reporters caused a crash and reached code execution only by chaining a second memory-address leak flaw. Saving to a file on disk is not affected. Scored 9.2/10, and CISA analysts note a public proof of concept.
  • A separate critical memory bug reuses stale image data after a mode change.

Remediação

  • Upgrade with pip install -U "Pillow>=13.0.0" and rebuild containers, wheels and base images bundling older copies. Pillow 13 drops Python 3.10, so Python 3.11 or newer is required.
  • EPS: keep gs off hosts that process untrusted uploads and never pass an attacker-controlled filename to Image.open() for EPS.
  • JPEG: avoid draft() and thumbnail() on untrusted JPEGs, call load() first, or pass reducing_gap=None.
  • TIFF: treat saving to an in-memory buffer as a sensitive path for user-supplied images.

Linha do tempo

  1. thehackernews.com ↗ · pub. 23/10/2026 06:36 · coletado 23/10 08:00 primeiro registro

    Pillow 13.0.0 fixes critical flaws incl. EPS/Ghostscript command execution (CVE-2026-112900), JPEG and TIFF memory bugs

    ler a análise desta fonte

    Pillow, the most widely used Python image library (about 436 million downloads a month, per OX Security), shipped version 13.0.0 on October 16 with a large security release. It fixes flaws across all severity levels, two of them rated critical by the maintainers. The headline issue, CVE-2026-112900, lets an attacker who controls the filename of an EPS file run OS commands through Ghostscript. None of the flaws is known to be exploited. Upload endpoints that build stored filenames from user input are the realistic target.

    Technical Details

    • CVE-2026-112900: Pillow passes the EPS filename to Ghostscript (gs) without validation. Ghostscript can interpret an attacker-chosen name as instructions and point to a second file carrying commands. It affects Pillow 2.6.0 through 12.3.0 and only hosts with gs installed. The trigger is the filename, not the PostScript content. The maintainers rate it moderate, while the GitHub-assigned CVE record scores it 9.2/10. CISA analysts mark no known exploitation.
    • FlashPix (FPX) JPEG overflow: demonstrated to run an attacker's command from a single Image.open() call on a crafted file when the optional olefile package is installed. Pillow identifies files by content, not extension, so servers opening untrusted uploads can be hit with no user action.
    • CVE-2026-112403: buffer overflow when creating a thumbnail of a crafted lossless JPEG. The advisory reports a crash, not code execution. It was found by Anthropic using Claude and validated manually by Ada Logics. Scored 9.2/10.
    • CVE-2026-112393: buffer overflow, present since 2013, when saving a compressed TIFF to memory (e.g. io.BytesIO). Reporters caused a crash and reached code execution only by chaining a second memory-address leak flaw. Saving to a file on disk is not affected. Scored 9.2/10, and CISA analysts note a public proof of concept.
    • A separate critical memory bug reuses stale image data after a mode change.

    Remediation

    • Upgrade with pip install -U "Pillow>=13.0.0" and rebuild containers, wheels and base images bundling older copies. Pillow 13 drops Python 3.10, so Python 3.11 or newer is required.
    • EPS: keep gs off hosts that process untrusted uploads and never pass an attacker-controlled filename to Image.open() for EPS.
    • JPEG: avoid draft() and thumbnail() on untrusted JPEGs, call load() first, or pass reducing_gap=None.
    • TIFF: treat saving to an in-memory buffer as a sensitive path for user-supplied images.