PolicyCortex
Request Access
Summary
  • Pillow 13.0.0, released October 16, 2026, fixes four flaws scored 9.2.
  • The flaws cover EPS filenames, FlashPix JPEG, lossless JPEG, and TIFF saves.
  • Each flaw needs ordinary image handling, not a rare setup, to trigger.
  • Upgrade to Pillow 13.0.0, rebuild containers, and record the new version.
  • No wild exploitation is reported in the advisories checked for this article.

A library in nearly every image pipeline

Pillow is a Python imaging library. It opens, converts, resizes, and saves images. Web upload forms, avatar tools, thumbnail services, and document pipelines use it. Many Python machine learning projects pull it in too.

Pillow 13.0.0 arrived October 16, 2026. It fixes a long list of security flaws. Four of those flaws carry a score of 9.2. That score is high enough to treat the upgrade as urgent.

Common Vulnerabilities and Exposures (CVE) is the public record system. The Common Vulnerability Scoring System (CVSS) rates severity from 0 to 10. A 9.2 is critical. It means network reach, low complexity, and full impact in the worst case.

The four 9.2 flaws

  • CVE-2026-112900 is EPS filename argument injection into Ghostscript. Pillow passes the filename to Ghostscript without normalizing it. A name starting with a hyphen becomes an option. A name starting with an at sign becomes an argument file. That can inject Ghostscript arguments. Full code execution needs control of the argument file too. Ghostscript must be installed. The flaw affects Pillow 2.6.0 through 12.3.0.
  • CVE-2026-112398 is a FlashPix JPEG tile heap overflow. Pillow reads the file by content, not by extension. A crafted file can overflow a tile buffer during a normal open. The advisory shows command execution in the lab. The optional olefile package must be installed. The flaw affects Pillow up to 12.3.0.
  • CVE-2026-112403 is a lossless JPEG heap overflow. It triggers when a program asks for a smaller draft or thumbnail. Libjpeg-turbo 3.x ignores the requested scaling for lossless JPEG. It then writes full width rows into a smaller buffer. The advisory reports a crash. Code execution is possible, not demonstrated alone. The flaw affects Pillow up to 12.3.0.
  • CVE-2026-112393 is a TIFF save heap overflow. It triggers when a program saves a compressed TIFF to memory. Saving to a real file is not affected. The advisory reports a crash on a stock build. Code execution needed a second flaw that leaked addresses. The flaw affects Pillow 2.0.0 through 12.3.0.

Why the scores and the ratings differ

The CVE records score all four flaws at 9.2. Pillow's own release notes rate them differently. The notes list the EPS flaw as medium. They list the TIFF flaw as high. They list the JPEG flaws as critical.

That split is not a contradiction. A CVE score describes the worst plausible case. A maintainer rating weighs the conditions an attacker needs. Read both before you judge risk. Do not use the lower rating to delay the upgrade.

What is not yet known

No wild exploitation is reported in the advisories checked. A public proof of concept is reported for the TIFF flaw. The FlashPix advisory includes a lab proof of concept. The EPS advisory includes a lab proof of concept.

None of the four IDs is in the CISA Known Exploited Vulnerabilities catalog as checked October 25, 2026. That catalog lists flaws with confirmed wild exploitation. Absence from it is not safety. It is a snapshot in time.

What to do this week

First, list every service that uses Pillow. Check the version in each service. Include containers, wheels, and bundled copies. A version check on one host is not an inventory.

Second, upgrade to Pillow 13.0.0. Test first, because Pillow 13.0.0 drops Python 3.10. Rebuild every container image that carries Pillow. A pip upgrade on a running host does not fix a stale image.

Third, recheck the version after deploy. Record the version, the deploy date, and the recheck result. Keep that record with the release notes.

Fourth, reduce exposure while you patch. Remove Ghostscript from upload hosts that do not need it. Never pass an attacker chosen filename straight to Image.open. Rename uploads to a safe name you control.

The governance lesson

Image libraries are dependencies, not background detail. They parse untrusted input on every upload. A flaw in that layer is a flaw in the front door.

Most teams track their own code closely. Libraries get less attention. They sit in requirements files for years. This release is the reminder to inventory them like any other system.

Your evidence file for this release should hold five items. The Pillow inventory with versions. The release notes reference. The upgrade date per service. The container rebuild record. The recheck result. An assessor can follow that file without asking twice.

Sources

Next step

Want patch evidence linked to each control, without chasing spreadsheets? See how PolicyCortex collects it from live systems.

Questions on this record
Are these flaws being exploited in the wild?
No wild exploitation is reported in the advisories checked. The advisories show lab proof of concept work, not wild attacks. Patch before that changes.
What is Pillow?
Pillow is a Python imaging library. It opens, converts, resizes, and saves images. Many web services use it for uploads and thumbnails.
Does upgrading break Python 3.10?
Yes, Pillow 13.0.0 drops Python 3.10 support. Test on Python 3.11 or later before you deploy the upgrade.
Does PolicyCortex patch Pillow?
No. Project teams apply the upgrade. PolicyCortex helps teams keep the evidence: which version ran, when it changed, and what the recheck showed.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.

Further reading in this register

  1. Eight Listed 10.0 Flaws in HPE ArubaOS: Patch Your Wireless Controllers NowHPE published advisory HPESBNW05162 on October 22, 2026. It fixes 72 flaws in ArubaOS 8 and 10. HPE rates eight at 10.0, and one of those IDs needs a closer look.5 min
  2. CISA Sets a Three Day Patch Clock on a Collabora RCECISA added CVE-2026-110447 to its KEV catalog on October 23, 2026. The Collabora Online Built-in CODE Server flaw lets an attacker run code on a Nextcloud server. Federal agencies must fix it by October 26.5 min
  3. Two Okta Access Gateway Flaws, One Admin Console: Upgrade to 2026.10.2Okta published two Access Gateway advisories on October 22, 2026. One lets a signed-in user reach the admin console. The other lets an admin run system commands. Both are fixed in 2026.10.2.5 min

Verify the record this entry describes.

Request AccessBook a call
Published
Last updated
Unchanged since publication
Author
Leonard Esere