--- title: "Pillow 13.0.0 Four CVSS 9.2 Flaws: Upgrade Now" description: "Pillow 13.0.0 fixes four flaws scored 9.2. The flaws cover EPS, FlashPix JPEG, lossless JPEG, and TIFF handling." url: https://policycortex.com/blog/pillow-130-four-92-flaws sealed: 2026-10-25 register: blog/pillow-130-four-92-flaws records: 3 digest: sha3:f14a8147063ee10b2dcd48c19cb6b193fd35ae7b3b3bf4614f76faf9dcc81de0 --- # Four 9.2 Flaws in Pillow: Upgrade to Version 13.0.0 Now Resources / Blog Pillow 13.0.0 fixes four flaws scored 9.2. They reach code execution or heap corruption through ordinary image handling. Upgrade and rebuild. Leonard Esere · Sealed 2026-10-25 · Reading time 5 min Filed under: [Pillow](https://policycortex.com/blog/tags/pillow), [Python](https://policycortex.com/blog/tags/python), [image library](https://policycortex.com/blog/tags/image-library), [flaw remediation](https://policycortex.com/blog/tags/flaw-remediation), [governance](https://policycortex.com/blog/tags/governance) **Summary** - Pillow 13.0.0, released October 16, 2026, fixes four flaws scored 9.2. - The flaws cover EPS filenames, FlashPix JPEG, lossless JPEG, and TIFF saves. - Each flaw needs ordinary image handling, not a rare setup, to trigger. - Upgrade to Pillow 13.0.0, rebuild containers, and record the new version. - No wild exploitation is reported in the advisories checked for this article. ## A library in nearly every image pipeline Pillow is a Python imaging library. It opens, converts, resizes, and saves images. Web upload forms, avatar tools, thumbnail services, and document pipelines use it. Many Python machine learning projects pull it in too. Pillow 13.0.0 arrived October 16, 2026. It fixes a long list of security flaws. Four of those flaws carry a score of 9.2. That score is high enough to treat the upgrade as urgent. Common Vulnerabilities and Exposures (CVE) is the public record system. The Common Vulnerability Scoring System (CVSS) rates severity from 0 to 10. A 9.2 is critical. It means network reach, low complexity, and full impact in the worst case. ## The four 9.2 flaws - [CVE-2026-112900](https://www.cve.org/CVERecord?id=CVE-2026-112900) is EPS filename argument injection into Ghostscript. Pillow passes the filename to Ghostscript without normalizing it. A name starting with a hyphen becomes an option. A name starting with an at sign becomes an argument file. That can inject Ghostscript arguments. Full code execution needs control of the argument file too. Ghostscript must be installed. The flaw affects Pillow 2.6.0 through 12.3.0. - [CVE-2026-112398](https://www.cve.org/CVERecord?id=CVE-2026-112398) is a FlashPix JPEG tile heap overflow. Pillow reads the file by content, not by extension. A crafted file can overflow a tile buffer during a normal open. The advisory shows command execution in the lab. The optional olefile package must be installed. The flaw affects Pillow up to 12.3.0. - [CVE-2026-112403](https://www.cve.org/CVERecord?id=CVE-2026-112403) is a lossless JPEG heap overflow. It triggers when a program asks for a smaller draft or thumbnail. Libjpeg-turbo 3.x ignores the requested scaling for lossless JPEG. It then writes full width rows into a smaller buffer. The advisory reports a crash. Code execution is possible, not demonstrated alone. The flaw affects Pillow up to 12.3.0. - [CVE-2026-112393](https://www.cve.org/CVERecord?id=CVE-2026-112393) is a TIFF save heap overflow. It triggers when a program saves a compressed TIFF to memory. Saving to a real file is not affected. The advisory reports a crash on a stock build. Code execution needed a second flaw that leaked addresses. The flaw affects Pillow 2.0.0 through 12.3.0. ## Why the scores and the ratings differ The CVE records score all four flaws at 9.2. Pillow's own release notes rate them differently. The notes list the EPS flaw as medium. They list the TIFF flaw as high. They list the JPEG flaws as critical. That split is not a contradiction. A CVE score describes the worst plausible case. A maintainer rating weighs the conditions an attacker needs. Read both before you judge risk. Do not use the lower rating to delay the upgrade. ## What is not yet known No wild exploitation is reported in the advisories checked. A public proof of concept is reported for the TIFF flaw. The FlashPix advisory includes a lab proof of concept. The EPS advisory includes a lab proof of concept. None of the four IDs is in the CISA Known Exploited Vulnerabilities catalog as checked October 25, 2026. That catalog lists flaws with confirmed wild exploitation. Absence from it is not safety. It is a snapshot in time. ## What to do this week First, list every service that uses Pillow. Check the version in each service. Include containers, wheels, and bundled copies. A version check on one host is not an inventory. Second, upgrade to Pillow 13.0.0. Test first, because Pillow 13.0.0 drops Python 3.10. Rebuild every container image that carries Pillow. A pip upgrade on a running host does not fix a stale image. Third, recheck the version after deploy. Record the version, the deploy date, and the recheck result. Keep that record with the release notes. Fourth, reduce exposure while you patch. Remove Ghostscript from upload hosts that do not need it. Never pass an attacker chosen filename straight to Image.open. Rename uploads to a safe name you control. ## The governance lesson Image libraries are dependencies, not background detail. They parse untrusted input on every upload. A flaw in that layer is a flaw in the front door. Most teams track their own code closely. Libraries get less attention. They sit in requirements files for years. This release is the reminder to inventory them like any other system. Your evidence file for this release should hold five items. The Pillow inventory with versions. The release notes reference. The upgrade date per service. The container rebuild record. The recheck result. An assessor can follow that file without asking twice. ## Sources - Pillow 13.0.0 release notes, October 16, 2026, https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html - GitHub advisory GHSA-w889-685w-c8fh, EPS filename argument injection, https://github.com/advisories/GHSA-w889-685w-c8fh - GitHub advisory GHSA-5x8w-8jj5-q52h, FlashPix JPEG heap overflow, https://github.com/advisories/GHSA-5x8w-8jj5-q52h - GitHub advisory GHSA-8g5g-8vmr-9782, lossless JPEG heap overflow, https://github.com/advisories/GHSA-8g5g-8vmr-9782 - GitHub advisory GHSA-332p-7hrc-92wf, TIFF save heap overflow, https://github.com/advisories/GHSA-332p-7hrc-92wf - [CVE-2026-112900](https://www.cve.org/CVERecord?id=CVE-2026-112900) record, CVE Program. - [CVE-2026-112398](https://www.cve.org/CVERecord?id=CVE-2026-112398) record, CVE Program. - [CVE-2026-112403](https://www.cve.org/CVERecord?id=CVE-2026-112403) record, CVE Program. - [CVE-2026-112393](https://www.cve.org/CVERecord?id=CVE-2026-112393) record, CVE Program. - Original diagram by PolicyCortex. ## Next step Want patch evidence linked to each control, without chasing spreadsheets? See how [PolicyCortex](https://policycortex.com) collects it from live systems. **Questions on this record** **Q: Are these flaws being exploited in the wild?** A: No wild exploitation is reported in the advisories checked. The advisories show lab proof of concept work, not wild attacks. Patch before that changes. **Q: What is Pillow?** A: Pillow is a Python imaging library. It opens, converts, resizes, and saves images. Many web services use it for uploads and thumbnails. **Q: Does upgrading break Python 3.10?** A: Yes, Pillow 13.0.0 drops Python 3.10 support. Test on Python 3.11 or later before you deploy the upgrade. **Q: Does PolicyCortex patch Pillow?** A: No. Project teams apply the upgrade. PolicyCortex helps teams keep the evidence: which version ran, when it changed, and what the recheck showed. ## Related records Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page. - **proof.state**: [Proof of State](https://policycortex.com/proof/state). What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained. - **proof.change**: [Proof of Change](https://policycortex.com/proof/change). Who or what altered the environment, under what authority, with before and after state hashes. - **proof.agency**: [Proof of Agency](https://policycortex.com/proof/agency). What a machine was permitted to do before it acted, what it did, and what would have stopped it. - **architecture**: [Architecture](https://policycortex.com/architecture). How the chain is built and where it lives: inside your tenant, with no egress of evidence. ### Further reading in this register | Published | Entry | Reading | |---|---|---| | 2026-10-25 | [Eight Listed 10.0 Flaws in HPE ArubaOS: Patch Your Wireless Controllers Now](https://policycortex.com/blog/hpe-arubaos-100-flaws): HPE published advisory HPESBNW05162 on October 22, 2026. It fixes 72 flaws in ArubaOS 8 and 10. HPE rates eight at 10.0, and one of those IDs needs a closer look. | 5 min | | 2026-10-24 | [CISA Sets a Three Day Patch Clock on a Collabora RCE](https://policycortex.com/blog/collabora-code-server-kev-rce): CISA added CVE-2026-110447 to its KEV catalog on October 23, 2026. The Collabora Online Built-in CODE Server flaw lets an attacker run code on a Nextcloud server. Federal agencies must fix it by October 26. | 5 min | | 2026-10-24 | [Two Okta Access Gateway Flaws, One Admin Console: Upgrade to 2026.10.2](https://policycortex.com/blog/okta-oag-admin-console-command-injection): Okta published two Access Gateway advisories on October 22, 2026. One lets a signed-in user reach the admin console. The other lets an admin run system commands. Both are fixed in 2026.10.2. | 5 min | Verify the record this entry describes. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book) Dates of record - **Published**: 2026-10-25 - **Last updated**: Unchanged since sealing - **Author**: Leonard Esere - **Record**: https://policycortex.com/blog/pillow-130-four-92-flaws ## Register colophon | Seq | Label | SHA3-256 | Prev | |---|---|---|---| | REC 0000 | HEAD | c53c25858fa8 | 96f8552d390b | | REC 0001 | BODY | a65ea464b2a5 | c53c25858fa8 | | REC 0002 | RELATED RECORDS | f14a8147063e | a65ea464b2a5 | Head sha3:f14a8147063ee10b2dcd48c19cb6b193fd35ae7b3b3bf4614f76faf9dcc81de0. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.