Critical Pillow flaws allow code execution via crafted images

A critical security vulnerability in Pillow, the dominant image processing library for Python, allows attackers to execute arbitrary operating system commands on affected servers. The flaw, identified as CVE-2026-112900, was patched in version 13.0.0 released on October 16, 2026, affecting installations from version 2.6.0 up to 12.3.0.

What happened

The primary vulnerability involves how Pillow handles Encapsulated PostScript (EPS) files. When opening an EPS image, Pillow passes the filename directly to Ghostscript, a separate program used for rendering, without sanitizing the input first. An attacker can craft a malicious filename that Ghostscript interprets as instructions rather than a file path. This allows the attacker to point Ghostscript to a secondary file containing executable commands, effectively taking control of the server process.

This issue is particularly dangerous because the trigger is the filename itself, not the content of the image. As noted in the advisory, "The flaw is triggered by the filename, not by anything in the PostScript document." This means even a benign EPS file can cause harm if its name is manipulated by an attacker. The exploit requires the target server to have Ghostscript installed and for the application to accept user-controlled filenames during upload or processing.

In addition to the EPS flaw, version 13.0.0 addresses two other critical issues. One involves a memory overflow in JPEG decoding, specifically within the FlashPix format, which can lead to code execution if the optional olefile package is present. Another long-standing bug, present since 2013, causes a buffer overflow when saving compressed TIFF images to memory buffers like io.BytesIO, a common pattern in web services that re-encode uploads.

Key details

• Affected versions: Pillow 2.6.0 through 12.3.0 are vulnerable; version 13.0.0 contains the fixes.
• Primary vector: CVE-2026-112900 allows code execution via crafted EPS filenames passed to Ghostscript.
• Secondary vectors: Critical buffer overflows exist in JPEG thumbnail generation and TIFF memory saving operations.
• Discovery: The JPEG flaw was identified by Anthropic using Claude for security analysis, then validated by Ada Logics.
• Severity: GitHub CVE records rate the EPS, TIFF, and JPEG flaws at 9.2 out of 10, though maintainers rate the EPS issue as moderate due to filename control requirements.
• Adoption: OX Security estimates Pillow is downloaded approximately 436 million times per month, indicating widespread exposure.

Background

Pillow is a fork of the Python Imaging Library (PIL) and serves as the de facto standard for image manipulation in Python ecosystems. It is a dependency for countless web frameworks, document processing pipelines, and machine learning tools. Because it is so ubiquitous, vulnerabilities in Pillow have a broad blast radius, potentially impacting everything from simple avatar upload forms to complex document management systems.

Ghostscript is an interpreter for the PostScript language and PDF files. Many Linux distributions include it by default, and Python applications often rely on it to handle vector-based image formats like EPS. The interaction between Pillow and Ghostscript creates a bridge where improper input handling in one component can lead to command injection in the other, bypassing typical application-level security controls.

Why it matters

For teams running self-hosted software, this vulnerability highlights the risks inherent in relying on complex dependency chains. If your application accepts image uploads from users, such as profile pictures, scanned documents, or design assets, it is likely using Pillow. An unpatched instance could allow an attacker to gain shell access to your server simply by uploading a file with a specific name or structure.

The impact extends beyond immediate code execution. The TIFF vulnerability, which has existed for over a decade, demonstrates how legacy code can persist in critical infrastructure. Services that process images in memory for performance reasons, such as generating previews or converting formats on the fly, are specifically at risk. This affects many modern web applications that avoid writing temporary files to disk.

Furthermore, the discovery method signals a shift in how vulnerabilities are found. With AI agents now actively auditing open-source code, we may see a surge in reported flaws in mature libraries. Teams must be prepared for faster patch cycles and more frequent security updates in their core dependencies.

What you can do

• Upgrade immediately: Update Pillow to version 13.0.0 or later using pip install -U "Pillow>=13.0.0".
• Check Python version: Note that Pillow 13 drops support for Python 3.10, so you must upgrade to Python 3.11 or newer if you are still on 3.10.
• Rebuild containers: If you use Docker or other containerization tools, rebuild your images to ensure the new version is baked in, as old layers may retain the vulnerable library.
• Restrict Ghostscript: If you cannot upgrade immediately, remove the gs binary from hosts that process untrusted uploads to mitigate the EPS vulnerability.
• Sanitize filenames: Ensure that any file passed to Image.open() does not contain user-controlled data in its path or name.
• Avoid risky operations: Refrain from using draft() or thumbnail() on untrusted JPEGs, and avoid saving compressed TIFFs to memory buffers until patched.