A critical Pillow vulnerability can let attackers run operating-system commands on a server when they control the filename of an Encapsulated PostScript (EPS) image processed by the Python library. Tracked as CVE-2026-112900, the flaw affects Pillow versions 2.6.0 through 12.3.0 and is fixed in Pillow 13.0.0, released October 16, 2026.
Key Points
- The flaw can lead to command execution when an attacker controls an EPS filename passed to Pillow.
- It affects Pillow 2.6.0 through 12.3.0 and requires Ghostscript to be installed on the affected host.
- Pillow 13.0.0 contains the fix, but it requires Python 3.11 or newer.
- The vulnerability had not been observed in active attacks at the time of the reports.
How the flaw works
CVE-2026-112900: Ghostscript Argument Injection
Pillow passes an EPS filename to Ghostscript, the external program it uses to convert EPS images into pixels, without first checking the filename. Ghostscript can interpret an attacker-selected filename as instructions and be directed to a second file containing commands to execute.
The flaw is triggered by the filename, not by the contents of the PostScript document, so a harmless EPS file can still be dangerous if its filename is controlled by an attacker. Exploitation requires Ghostscript, available as the gs program, to be installed on the host because Pillow relies on it to open EPS files.
Upload services are among the relevant exposure points when they retain or construct stored filenames from user input. Pillow is also used in avatar and thumbnail tools, document and PDF processing pipelines, and machine-learning projects. OX Security estimated that Pillow is downloaded approximately 436 million times per month.
Severity and other fixes
The GitHub-assigned CVE record gives CVE-2026-112900 a score of 9.2 out of 10, while Pillow’s maintainers classify the EPS issue as moderate because exploitation requires control of the filename. The EPS flaw was not known to be under attack; reports also noted no known active exploitation of the vulnerabilities they covered.
Pillow 13.0.0 also addresses several other security issues. These include stale image data being reused after a mode change, two JPEG-decoding overflow flaws, and a FlashPix issue that can allow command execution through a single Image.open() call when the optional olefile package is installed.
The release also fixes CVE-2026-112403, a buffer overflow during thumbnail creation from a crafted lossless JPEG that the advisory said could cause a crash, and CVE-2026-112393, a compressed-TIFF memory-buffer overflow present since 2013. Code execution for the TIFF issue requires a separate memory-address disclosure flaw, and saving to a real file on disk is not affected. The three issues covered in one report received CVSS scores of 9.2.
CVE-2026-112403: JPEG Thumbnail Buffer Overflow
CVE-2026-112393: TIFF Memory-Buffer Overflow
io.BytesIONote: Code execution requires an additional memory-address disclosure vulnerability. Saving directly to a regular file on disk is not affected by this issue.
Anthropic found one of the JPEG issues using Claude to study open-source software, and Ada Logics manually validated it. The vulnerabilities were disclosed on October 19, 2026, three days after Pillow 13.0.0 was released.
Updating and reducing risk
Organizations should upgrade to Pillow 13.0.0 and rebuild containers, wheels, and base images that include older versions. Pillow 13 dropped support for Python 3.10, so environments that need the update must use Python 3.11 or newer.
Until systems are updated, operators can remove or keep gs off hosts that process untrusted uploads and avoid passing attacker-controlled filenames to Image.open() for EPS files. For untrusted JPEGs, the guidance is to avoid draft() and thumbnail(), or call load() first or use reducing_gap=None; compressed TIFF saves to in-memory buffers such as io.BytesIO should also be treated as sensitive when images come from users.
About the Author
