Pillow 13.0.0 Fixes Critical Image-Processing Flaws, Including Code Execution Paths
Pillow maintainers released version 13.0.0 on October 16 after fixing several security flaws in the Python image library. The most consequential issue, CVE-2026-112900, can allow operating-system commands to run when Pillow opens an EPS image through Ghostscript and an attacker controls the filename. The release affects applications that process images in upload forms, avatar and thumbnail services, document or PDF pipelines, and machine-learning projects.
The EPS vulnerability is not primarily about malicious pixels inside an image. Pillow passes the filename to Ghostscript without checking it first, and Ghostscript can interpret an attacker-selected name as instructions pointing to another file containing commands. The practical exposure is therefore concentrated in systems that process untrusted uploads, retain user-controlled filenames, and have the gs program installed. The supplied evidence reports no known exploitation of the flaw, but identifies attacker-controlled filenames as the condition that makes the path reachable.
The update also addresses separate memory-safety problems. One JPEG-related issue can execute an attacker’s command from a crafted FlashPix file when the optional olefile package is installed and the application opens the file. Another flaw can overflow a buffer while generating a thumbnail from a crafted lossless JPEG, while a TIFF issue affects applications that save compressed TIFF data to an in-memory buffer rather than to disk. These paths have different prerequisites, so teams should review how their services decode, resize, convert, and store uploaded images instead of treating every deployment as equally exposed.
The supported remediation is to upgrade to Pillow 13.0.0 and rebuild containers, wheels, or base images that include an older copy. Environments that still run Python 3.10 need additional planning because Pillow 13 no longer supports that Python release. Until an upgrade is possible, the published guidance recommends keeping Ghostscript off hosts that process untrusted uploads, never passing an attacker-controlled filename to Image.open() for EPS files, and avoiding draft() and thumbnail() on untrusted JPEGs unless the specified loading alternatives are used. TIFF data originating from users should be treated as sensitive when it is being saved to an in-memory buffer.