Critical Flaw in Python's Pillow Library Allows Remote Code Execution Through Crafted Filenames

Python's widely used Pillow image library has addressed multiple security vulnerabilities, including a critical flaw tracked as CVE-2026-112900 that could allow operating system command execution. According to security reports and project maintainers, the issue stems from how Pillow handles EPS images by passing filenames to Ghostscript without prior validation.

OX Security reported that the library experiences approximately 436 million monthly downloads, appearing frequently in web upload forms, thumbnail tools, and machine-learning workflows. Pillow maintainers released version 13.0.0 on October 16 to resolve these vulnerabilities.

Summary of Key Findings and Technical Details

• EPS and Ghostscript Flaw (CVE-2026-112900): Triggered by an attacker-controlled filename rather than the image content itself, affecting hosts with Ghostscript installed. GitHub assigned this CVE a 9.2 out of 10 critical rating, while maintainers rate it moderate due to the prerequisite of filename control.
• JPEG and FlashPix Issues: Includes overflow flaws in JPEG decoding and FlashPix formats. One issue involving lossless JPEG thumbnails (CVE-2026-112403) was identified using AI analysis tools by Anthropic and validated by Ada Logics, resulting in crashes rather than direct code execution.
• TIFF Memory Buffer Bug (CVE-2026-112393): Present since 2013, this flaw triggers when saving compressed TIFF images to an in-memory buffer instead of a disk file. Attackers reportedly required a secondary vulnerability leaking memory addresses to achieve code execution.

Practical Implications and Mitigation Steps

Organizations utilizing older versions of Pillow (ranging from 2.6.0 up to 12.3.0) are advised to take immediate action:

• Upgrade to Version 13.0.0: Update the library and rebuild all containers or base images. Note that Pillow 13 requires Python 3.11 or newer, dropping support for Python 3.10.
• Environment Hardening: Keep the `gs` (Ghostscript) program off hosts processing untrusted uploads, and avoid passing user-controlled filenames directly to `Image.open()` for EPS files.
• Alternative Workarounds: Avoid using `draft()` and `thumbnail()` on untrusted JPEGs or call `load()` first, and treat saving TIFF images to in-memory buffers like `io.BytesIO` as a sensitive operation.

Advisories indicate that none of the flaws are currently known to be under active attack, though public proofs of concept exist for specific vulnerabilities. Users can verify official announcements and patch notes directly through the official Python Pillow repository and GitHub security advisories.