Python’s most popular image library has a serious problem. Pillow, the package that handles images in everything from web upload forms to machine-learning pipelines, was found to carry several memory and command-execution flaws. The worst of them lets an attacker run operating system commands on a server just by controlling the name of a file the library is told to open. The maintainers fixed the batch in Pillow 13.0.0, released on 16 October 2026, and anyone running older versions should treat this as an urgent upgrade.
What Happened
Security firm OX Security published research that drew attention to a set of flaws in Pillow. The most discussed one is tracked as CVE-2026-112900. It exists in the way Pillow handles EPS images, a PostScript-based format. When Pillow opens an EPS file, it passes the file’s name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.
Ghostscript can interpret an attacker-chosen file name as instructions instead of as a plain file path, and point the process to a second file that carries commands to execute. The fix landed in Pillow 13.0.0.
That matters because Pillow turns up almost everywhere Python handles images: web upload forms, avatar and thumbnail tools, document and PDF pipelines and most machine-learning projects. OX Security estimates the library is downloaded about 436 million times a month.
The EPS Ghostscript Flaw in Detail
The advisory is blunt about the root cause: the flaw is triggered by the filename, not by anything inside the PostScript document. A harmless EPS file can still cause damage when an attacker has a say in what the file is called.
That makes upload endpoints that keep or build a stored file’s name from user input the realistic target. Think of a web app that saves an upload as whatever name the user provided and then calls Pillow to process it.
There is one environmental condition. The flaw only reaches Ghostscript on hosts that have the gs program installed, which Pillow needs before it can open EPS images at all. It affects Pillow from version 2.6.0 up to 12.3.0.
The maintainers rate this one moderate, since the attacker has to control the filename. The CVE record assigned by GitHub rates it 9.2 out of 10. Both ratings describe the same condition from different angles.
The Other Critical Bugs
Version 13.0.0 is a large security release with fixes across four severity levels, from low to critical. Two of them are rated critical by the maintainers.
- Stale image data after a mode change. A memory bug where image data is reused after the image mode changes.
- FlashPix (FPX) overflow. Part of a pair of JPEG decoding overflows. This one was shown to run an attacker’s command from a single call to Image.open() on a crafted file, as long as the optional olefile package is installed. Pillow recognizes these files by their content, not their extension, so a server that opens untrusted uploads can be hit with no user action beyond the upload itself.
- Lossless JPEG thumbnail overflow (CVE-2026-112403). Overflows a memory buffer when a program makes a thumbnail of a crafted lossless JPEG. Its advisory reports a crash rather than code execution.
- TIFF save-to-memory overflow (CVE-2026-112393). Present in Pillow since 2013. It overflows a memory buffer when a program saves a compressed TIFF image to memory instead of to a file on disk, which is the common pattern for a service that re-encodes an upload and hands it back. Saving to a real file on disk is not affected. The reporters crashed the process with it and turned it into code execution only with the help of a second, separate flaw that leaked memory addresses.
The CVE records, assigned by GitHub, score the EPS, TIFF and JPEG-thumbnail flaws 9.2 out of 10. One detail worth noting about the discovery process: the JPEG thumbnail bug was found by Anthropic using Claude to study the security of open-source software and validated manually by Ada Logics, part of a wider effort that has turned up hundreds of flaws in open-source libraries.
None of these flaws is known to be under active attack right now. CISA’s analysts mark no known exploitation for the EPS flaw, though a public proof of concept exists for the TIFF one.
Who Is Affected
If your Python project processes images from users, assume you are affected. The usual suspects include:
- Web applications that accept image uploads for avatars, listings or documents
- Thumbnail and image-resizing services built on Pillow
- Document and PDF pipelines that convert EPS or TIFF inputs
- Machine-learning data pipelines that decode images with Pillow
- Any container or base image that bundles an old Pillow wheel
The EPS and FPX paths need specific conditions, such as a user-controlled filename or the olefile package being installed, but the safe assumption for a security update is that untrusted images can reach all of these code paths.
How to Fix It Now
Upgrade to Pillow 13.0.0, which fixes every flaw in this batch.
pip install -U "Pillow>=13.0.0"Then rebuild any containers, wheels or base images that bundle an older copy. Two extra points from the release:
- Pillow 13 drops Python 3.10. If your installs are still on Python 3.10, you need to move to Python 3.11 or newer before you can take the fixed version.
- Check your dependency lockfiles. Many projects pin Pillow behind a caret or tilde range that will not pick up a major version automatically.
What Development Teams Should Check Today
Rolling out the fix cleanly takes a small inventory pass. A practical checklist for any Python team:
- Find every Pillow install. Check your requirements files, lockfiles, Poetry exports, and any Docker base image that runs pip install. Sub-dependencies often pull Pillow in without anyone noticing.
- Confirm your Python version. If you are on Python 3.10, your upgrade path includes a Python bump, which is a bigger change than a one-line dependency edit. Plan accordingly.
- Search your codebase for user-controlled filenames. Any call to Image.open() or similar where the filename comes from request data is a risk until you are on 13.0.0.
- Rebuild and redeploy containers. A fixed requirements file does nothing for a container image that was built last month with Pillow 10 baked in.
None of these steps is complicated, but the 436 million monthly downloads figure shows how easy it is for an old copy of this library to survive in a forgotten corner of a project.
If You Cannot Upgrade Yet
Pillow’s security guidance and the advisories point to steps that cut each attack path while you plan the upgrade.
- EPS and Ghostscript: keep the gs program off any host that processes untrusted uploads, and never pass an attacker-controlled filename to Pillow. Open uploads as file objects and generate your own storage names.
- FPX: if you do not need FlashPix support, block the format at your upload filter.
- TIFF to memory: save compressed TIFF output to a real file on disk rather than to memory.
These are stopgaps. The fix is 13.0.0, and anything older than 12.3.0 carries the full set of issues.
Frequently Asked Questions
What is the Pillow vulnerability in Python?
CVE-2026-112900 is the headline flaw. It lets an attacker run operating system commands by controlling the name of an EPS file that Pillow opens, because the name is passed to Ghostscript without validation. Several memory bugs in JPEG, FPX and TIFF handling were fixed in the same release.
Which Pillow versions are affected?
The EPS filename flaw affects Pillow from version 2.6.0 through 12.3.0. All of the flaws in this batch are fixed in version 13.0.0, released on 16 October 2026.
How do I update Pillow safely?
Run pip install -U “Pillow>=13.0.0” and rebuild any containers or base images that ship an older wheel. Pillow 13 requires Python 3.11 or newer, since it drops Python 3.10 support.
Is the Pillow flaw being exploited in the wild?
There are no reports of active exploitation so far. CISA marks the EPS flaw with no known exploitation, while a public proof of concept exists for the TIFF issue. The recommended action is still to upgrade now rather than wait for attacks to appear.
