Pillow 13.0.0 Patches Critical Image-Parsing Flaws: Update Your Python Stack Now

Pillow is the default image library in most Python stacks. Its maintainers have shipped version 13.0.0 (released October 16), a large security release that fixes several memory-safety and command-execution bugs. The most notable one lets an attacker run operating-system commands on a server by controlling only the name of an image file. Nothing in the image itself has to be malicious. No in-the-wild exploitation has been reported so far, but Pillow sits under upload forms, thumbnail services, document pipelines and ML projects, so the realistic exposure is large.

What happened

The 13.0.0 release fixes issues ranging from low to critical severity. The ones that matter most for defenders:

• CVE-2026-112900 (EPS / Ghostscript). To open EPS images, Pillow hands the file name to the external Ghostscript (gs) program without validating it. A crafted name can make Ghostscript treat it as instructions and load attacker-supplied commands. The bug only matters on hosts where gs is installed, and the attacker must be able to influence the filename. That is exactly what happens on upload endpoints that keep or derive stored names from user input. It affects Pillow 2.6.0 through 12.3.0.
• JPEG decoding overflows (maintainer-rated critical). One of them, in the FlashPix (FPX) path, was demonstrated to execute commands from a single Image.open() call on a crafted file when the optional olefile package is present. Pillow picks the decoder from the file's content, not its extension, so a renamed upload still reaches it. A second one, CVE-2026-112403, overflows a buffer while generating a thumbnail of a crafted lossless JPEG. The advisory reports a crash, not code execution. That flaw was found with AI-assisted research and validated manually.
• CVE-2026-112393 (TIFF). This overflow has been in Pillow since 2013. It triggers when a compressed TIFF is saved to an in-memory buffer, which is the usual pattern for services that re-encode an upload and return it. On its own it crashes the process. The reporters only reached code execution by chaining it with a separate memory-disclosure bug. Saving to a regular file on disk is not affected.
• A memory-handling bug where stale image data is reused after a mode change, also rated critical by the maintainers.

Why it matters

The CVE records score the EPS, TIFF and JPEG-thumbnail bugs at 9.2/10. Each one also depends on preconditions the score doesn't fully capture, and the maintainers' own ratings for the batch range from moderate to critical. So read these as "critical if your code path matches," not "critical everywhere." At publication, no exploitation of the EPS flaw is known, while a public proof of concept exists for the TIFF issue. Pillow is downloaded hundreds of millions of times a month and is often pulled in transitively. Many teams run it without knowing it, frequently inside container images that haven't been rebuilt in months.

What to do

1. Upgrade to Pillow 13.0.0 everywhere: pip install -U "Pillow>=13.0.0". Pillow 13 drops Python 3.10, so those environments also need Python 3.11+.
2. Rebuild every container, wheel and base image that vendors an older Pillow. Updating the lockfile alone is not enough.
3. Find it transitively. Check dependency trees and SBOMs, not just requirements.txt. Pillow often arrives through ML, PDF and reporting libraries.
4. Until you can patch, cut each path:
   • EPS: remove gs from hosts that handle untrusted uploads, and never pass a user-controlled filename to Image.open().
   • JPEG thumbnails: avoid draft()/thumbnail() on untrusted JPEGs, or call load() first, or pass reducing_gap=None.
   • TIFF: treat saving user-supplied images to io.BytesIO as a sensitive path.
   • Generate server-side file names instead of keeping the uploaded ones.

Our AI-assisted code review looks for this class of risk: an outdated library buried in a dependency tree, plus code that passes user-controlled input such as file names into it. Our analysts then confirm each match before it reaches your report.

Credit: this article summarizes and expands on original reporting by The Hacker News. Technical details are drawn from that report and the Pillow project's security advisories.