Critical Python Pillow Flaw Allows Code Execution Through Crafted Filenames

A Python Pillow RCE vulnerability, tracked as CVE-2026-112900, could allow attackers to execute operating-system commands when vulnerable applications process an attacker-controlled EPS filename through Ghostscript.

The security issue affects Pillow versions 2.6.0 through 12.3.0 and was fixed in Pillow 13.0.0, released on October 16, 2026. The vulnerability is particularly relevant to web services that preserve user-controlled filenames while processing image uploads.

The flaw does not require malicious instructions inside the EPS image itself. Instead, the risk arises because Pillow can pass an unsafe filename to Ghostscript, allowing specially formed filenames to be interpreted as command-line arguments.

Pillow 13.0.0 also fixes several separate vulnerabilities affecting FlashPix, JPEG, TIFF and other image-processing operations. Some of those memory-corruption issues have demonstrated code-execution potential under specific conditions.

Developers running image-upload services, thumbnail generators, document-conversion tools and other Python applications that process untrusted images should inventory their Pillow versions and upgrade to 13.0.0 or later.

For more enterprise vulnerability analysis and patch-management guidance, explore our CVE Vulnerabilities and Enterprise Security Hub.

Key Findings From the Python Pillow Security Update

• Primary vulnerability: CVE-2026-112900, Ghostscript argument injection with potential remote code execution.
• Affected versions: Pillow 2.6.0 through 12.3.0 for the EPS filename flaw.
• Fixed version: Pillow 13.0.0, released October 16, 2026.
• Required exposure conditions: Attacker-influenced filename, affected EPS processing path and an available Ghostscript executable.
• Additional serious flaws: FlashPix heap overflow, JPEG thumbnail buffer overflow and TIFF encoding memory corruption.
• Compatibility change: Pillow 13.0.0 no longer supports Python 3.10.
• Recommended action: Upgrade affected installations, rebuild deployment images and verify the running Pillow version.

Python Pillow RCE CVE-2026-112900: How the Vulnerability Works

Pillow is a widely used Python imaging library that applications rely on to open, transform, resize and save images.

It supports many image formats through Python modules and native image-processing components.

One supported format is Encapsulated PostScript, commonly called EPS.

When Pillow processes an EPS image, it can invoke Ghostscript, a separate program used to render PostScript content.

The vulnerable code passes an image’s filename into Ghostscript’s command-line arguments without adequately protecting it from interpretation as an option.

A filename beginning with certain special characters can therefore be interpreted as a Ghostscript argument rather than a normal file path.

If an attacker can influence the filename that reaches this processing path, they may be able to change how Ghostscript handles subsequent input.

Under the documented conditions, this can be chained into operating-system command execution.

The vulnerability is associated with CWE-88, improper neutralization of argument delimiters, and CWE-78, operating-system command injection.

The key distinction is that the filename triggers the problem, not necessarily malicious PostScript instructions inside the image.

Why an Innocent-Looking Image Filename Can Become Dangerous

Many web applications accept uploaded images and store them using filenames derived from user input.

For example, an image-processing workflow may accept an uploaded file, retain its name and later pass that file to Pillow’s Image.open() interface.

That workflow can become risky when a downstream image plugin sends the filename to another application without preserving its intended meaning.

In the affected EPS processing path, Pillow constructs a Ghostscript command containing the image path.

Ghostscript may interpret specially structured filenames as options or argument-file references.

Consequently, the filename can influence processing beyond merely identifying which file should be opened.

The maintainers’ advisory explains that Ghostscript’s default safer execution mode does not independently eliminate this argument-injection problem.

However, not every Pillow image upload is vulnerable.

An application must reach the affected EPS processing route, Ghostscript must be available, and an attacker must be able to influence the relevant filename.

Applications processing ordinary PNG or JPEG images without the affected Ghostscript path should not be described as automatically exploitable through CVE-2026-112900.

Which Pillow Versions Are Vulnerable to CVE-2026-112900?

The project’s GitHub advisory identifies the following affected range:

The relevant severity descriptions also require careful interpretation.

Pillow’s own advisory rates the EPS filename vulnerability Moderate, while the associated CVE record carries a Critical CVSS 4.0 score of 9.2.

Those assessments reflect different scoring approaches and assumptions.

The high CVSS score should not be used to imply that every application using Pillow permits unauthenticated remote code execution.

Exposure depends on the documented filename-control and Ghostscript conditions.

Critical FlashPix Heap Overflow Can Execute Code From a Crafted File

Pillow 13.0.0 also resolves a separate Critical vulnerability involving FlashPix image decoding.

The project tracks this issue under GitHub advisory GHSA-5x8w-8jj5-q52h.

The vulnerability involves a heap buffer overflow in the JPEG-tile decoding process used for FlashPix files.

Under affected conditions, the decoder can allocate a memory buffer that is too small for the image data it subsequently writes.

This creates the possibility of memory corruption and code execution.

The advisory documents a proof of concept demonstrating command execution when opening a specially crafted FlashPix file.

The affected processing route requires the optional olefile dependency, which Pillow uses for certain compound-document image formats.

Importantly, Pillow can recognize these files through their actual content rather than relying solely on the filename extension.

This means an application that checks only whether a filename ends with a familiar image extension may not prevent the vulnerable decoder from being reached.

The maintainers identify Pillow 13.0.0 as the patched version.

This FlashPix vulnerability is distinct from CVE-2026-112900 and does not depend on the EPS filename argument-injection mechanism.

CVE-2026-112403: JPEG Thumbnail Buffer Overflow

Another important vulnerability fixed in Pillow 13.0.0 is CVE-2026-112403.

The flaw affects JPEG decoding when an application requests downscaling through certain processing paths.

Pillow’s draft() method can request reduced-resolution JPEG output.

The library’s thumbnail() operation can use that mechanism automatically.

Under the vulnerable conditions, a specially formed lossless JPEG may cause the decoder to return image rows wider than the destination buffer expects.

This results in a heap buffer overflow.

The issue depends on a JPEG decoding implementation that supports the relevant lossless JPEG format, including libjpeg-turbo 3.x in documented affected configurations.

The advisory reports crash and memory-corruption behavior, with potential code-execution consequences.

It does not establish that every JPEG processed by Pillow triggers the issue.

The affected operation is specifically associated with image downscaling and the resulting mismatch in buffer dimensions.

The project credits Anthropic’s Claude for identifying the issue, with manual validation by Ada Logics.

This makes CVE-2026-112403 a documented example of AI-assisted open-source vulnerability discovery.

CVE-2026-96639: Stale Image Storage After Mode Changes

CVE-2026-96639 is another Critical issue addressed in the Pillow 13.0.0 release.

It concerns the reuse of native image storage when an image’s logical mode changes during multi-frame processing.

For example, a decoder may initially allocate storage for a frame requiring relatively little memory per pixel.

If a later frame uses a wider pixel representation but the old allocation is reused, the application may write more data than the allocation can hold.

The vulnerability affects documented multi-frame processing paths involving formats such as PSD, MPO, DCX and MIC.

The resulting memory corruption can cause crashes or other serious security consequences.

The advisory also describes code-execution behavior under specific runtime conditions.

As with other memory-safety vulnerabilities, the actual impact depends on the supported decoder, crafted input and runtime environment.

Applications that process user-controlled multi-frame images should prioritize the fixed release.

Other Pillow 13.0.0 Security Fixes

The October security release contains more than the EPS, JPEG and FlashPix issues highlighted above.

According to the project’s release notes, additional fixes cover several image-processing and parsing operations.

This is a representative selection, not the complete list of fixes in the release.

Several advisories have different prerequisites and potential outcomes.

Developers should consult the original project release notes rather than assuming all these findings enable code execution.

OX Research’s code analysis illustrates a vulnerable TIFF buffer-resizing condition in Pillow before version 13.0.0. The issue involves an allocation-size calculation that could allow data to be written beyond the intended buffer boundary. This is separate from the Ghostscript filename-injection vulnerability CVE-2026-112900.

Why Python Image Upload Services Face Security Risks

Pillow is frequently used in applications that accept, transform or store images.

Common workloads include profile-picture uploads, thumbnail generation, content-management systems, document processing and machine-learning data pipelines.

These services may receive files from users who are not fully trusted.

Even when an application intends only to resize an image, a complex file decoder may process headers, frame metadata and embedded image data before producing the output.

That creates opportunities for memory-safety flaws and unexpected parser behavior.

Filename handling introduces another trust boundary when image-processing code invokes external utilities.

The Pillow EPS issue is an example of this second category.

For developers, the relevant security question is not simply whether Pillow appears in a dependency list.

It is whether untrusted input can reach the vulnerable format parser or command-invocation path.

A service that processes only internally generated images may have a different exposure profile from a public upload endpoint that accepts arbitrary content.

Nevertheless, upgrading remains the preferred response because older Pillow releases contain several separate security issues.

How to Check Whether Your Python Application Uses Vulnerable Pillow

Administrators should check the installed package version in the actual application environment.

Check Pillow With pip

Run the following command in the relevant Python environment:

python -m pip show Pillow

This displays package information including the installed version and location.

You can also inspect the version through Python:

python -c "import PIL; print(PIL.__version__)"

Compare the result with the patched release, Pillow 13.0.0.

Check virtual environments separately because different applications may depend on different package installations.

Check Your Python Version

Pillow 13.0.0 drops support for Python 3.10.

Check your runtime:

python --version

If the application still uses Python 3.10, plan a compatible runtime upgrade before attempting to install Pillow 13.0.0.

Use Python 3.11 or a later version supported by Pillow and the application’s dependencies.

Inspect Docker Containers

For applications running inside Docker, inspect the package within the actual container:

docker exec <container_name> \
  python -m pip show Pillow

Replace the placeholder with the authorized container name or identifier.

A patched developer workstation does not prove that the production container contains the updated library.

How to Fix CVE-2026-112900 and Other Pillow Vulnerabilities

The maintainers recommend upgrading Pillow to version 13.0.0 or later.

In an application environment using a compatible Python runtime, the following command installs an appropriate supported release:

python -m pip install --upgrade "Pillow>=13.0.0"

Before updating production workloads, review application compatibility and the Pillow 13.0.0 release notes.

Because the update removes Python 3.10 support and includes backward-incompatible changes, application testing is necessary.

Update Dependency Lockfiles

After validating the upgrade, update the package constraints and lockfiles used by the application.

Common dependency-management systems may include pip, Poetry, pip-tools or other Python packaging workflows.

Ensure the intended Pillow version is reproducible in CI and production rather than relying only on a manual upgrade in one environment.

Rebuild Docker and Kubernetes Workloads

For containerized applications, build a fresh image containing the updated Python runtime and Pillow package.

Redeploy the image through the normal release process.

Verify the installed Pillow version inside running containers or pods after deployment.

Previously created images may continue carrying an older Pillow installation even after the project dependency file is updated.

Check for Ghostscript Exposure

If an application processes externally supplied EPS files, determine whether Ghostscript is installed and reachable by the image-processing workflow.

Where EPS processing is unnecessary, remove or disable that functionality as an exposure-reduction measure.

Avoid preserving attacker-controlled filenames in paths that reach external utilities.

However, filename validation alone should not replace installing the official Pillow security fix.

Temporary Mitigations if Pillow Cannot Be Upgraded Immediately

Organizations that cannot deploy Pillow 13.0.0 immediately should reduce exposure to the affected processing paths.

These measures are temporary and must be evaluated against the application’s actual design.

EPS and Ghostscript

Do not allow untrusted EPS filenames to reach the affected Ghostscript execution path.

Where Ghostscript and EPS handling are unnecessary, remove the relevant functionality or restrict it from untrusted upload workflows.

Generate trusted server-side filenames rather than using arbitrary client-supplied names for processing.

JPEG Thumbnail Generation

The JPEG advisory describes exposure involving draft() and certain thumbnail() operations.

Where an immediate update is impossible, developers can review whether their application reaches that downscaling path.

The advisory describes avoiding draft(), loading the image before thumbnailing, or using the documented reducing_gap=None behavior as possible ways to avoid that particular vulnerable route.

These are specific to the JPEG issue and do not fix the unrelated EPS or FlashPix vulnerabilities.

Restrict Untrusted Image Formats

Use explicit content-validation rules when only a small set of image formats is required.

Check actual file contents rather than trusting only filename extensions or browser-provided content types.

However, format allowlisting is not a substitute for updating a vulnerable decoder, especially when the accepted format itself contains a security flaw.

Limit Image-Processing Privileges

Run image-processing services under dedicated, low-privilege identities wherever practical.

Restrict unnecessary filesystem access, network connectivity and sensitive credentials.

Consider isolating untrusted conversion workloads from critical application components.

These controls can reduce the consequences of a compromise but do not eliminate the underlying software vulnerabilities.

Patch Verification Checklist for DevOps Teams

After updating Pillow, verify the result across the actual deployment environment.

• Python runtime: Confirm it is compatible with Pillow 13.0.0 or later.
• Package version: Inspect the installed Pillow version inside production environments.
• Dependency locks: Confirm the upgraded package is recorded in reproducible build files.
• Containers: Verify rebuilt images are deployed and older replicas have been retired.
• Image formats: Test supported upload, resizing and conversion workflows.
• Ghostscript: Review whether unnecessary EPS processing remains accessible.
• Privileges: Confirm image workers run with appropriate restrictions.
• Monitoring: Watch for unexpected worker crashes and abnormal image-processing behavior.
• Security review: Assess other native libraries bundled with the application.

Successful execution of a normal image-processing test does not prove that all vulnerabilities have been eliminated.

Version verification and the vendor’s published fix details provide the primary evidence that the software update addresses the reported issues.

Are the Pillow Vulnerabilities Being Actively Exploited?

The public reporting reviewed for this article does not establish a widespread campaign exploiting CVE-2026-112900 or the other October Pillow vulnerabilities.

Some published advisories contain reproducible proofs of concept demonstrating crashes or code-execution behavior.

Those demonstrations support the seriousness of the findings but should not be confused with evidence of confirmed attacks against real organizations.

The threat to a particular application depends on which formats it processes, which dependencies are installed and whether an attacker can reach the affected code.

Administrators should prioritize the supported fix while avoiding unsupported claims that all Pillow-based applications have already been compromised.

Confirmed vs Unknown: Python Pillow October 2026 Security Release

Confirmed

• Pillow 13.0.0 was released on October 16, 2026.
• CVE-2026-112900 concerns Ghostscript argument injection through attacker-influenced EPS filenames.
• The EPS issue affects Pillow versions 2.6.0 through 12.3.0.
• Ghostscript availability and filename control are important exploitation conditions.
• Other fixed vulnerabilities involve FlashPix, JPEG, TIFF and additional image-processing functionality.
• Some memory-corruption issues have demonstrated code-execution potential in controlled conditions.
• Pillow 13.0.0 removes Python 3.10 support.

Unknown or Not Established

• A confirmed widespread campaign exploiting CVE-2026-112900.
• A verified number of compromised organizations.
• That every Pillow installation exposes the affected EPS processing route.
• That ordinary PNG or JPEG processing automatically triggers the Ghostscript filename vulnerability.
• That every additional Pillow security issue enables remote code execution.
• That all Python applications can migrate to Pillow 13.0.0 without compatibility changes.

CyberUpdates365 Analysis

The Pillow vulnerabilities illustrate two important categories of risk in software that processes untrusted files.

The first is unsafe interaction with external tools.

CVE-2026-112900 demonstrates how an attacker-controlled filename can cross a security boundary when passed to Ghostscript as a command-line argument.

This problem is different from malicious code embedded inside the image content.

Even a harmless EPS document may become part of an unsafe workflow when its filename is interpreted as a command option.

The second category involves memory-safety vulnerabilities in native decoders.

Although Pillow exposes Python interfaces, much of its image-processing functionality depends on native code and external libraries.

That means ordinary Python-level input handling does not automatically protect an application from malformed image structures that trigger memory corruption.

The FlashPix and JPEG findings demonstrate why developers must consider which decoders are reachable from an upload endpoint.

An image extension is not always a reliable indicator of the format a library will recognize internally.

The October release also presents a practical dependency-management challenge.

Organizations using Python 3.10 cannot simply assume that upgrading Pillow is compatible with their existing runtime.

Some teams may need to update Python, rebuild container images and retest important image-processing workflows during the same security maintenance cycle.

For cloud environments, the most reliable approach is to combine automated dependency inventory, trusted builds, least-privilege image workers and post-deployment verification.

The broader lesson is that image uploads should be treated as untrusted code-processing inputs, not merely harmless pictures.

Research Evidence

• Project: Python Pillow.
• Fixed release: 13.0.0.
• Release date: October 16, 2026.
• Main CVE: CVE-2026-112900.
• EPS vulnerability type: Ghostscript argument injection, potentially leading to code execution.
• Affected EPS versions: 2.6.0 through 12.3.0.
• Key prerequisite: Attacker-influenced filename reaching EPS processing with Ghostscript available.
• Additional serious issue: FlashPix heap overflow, GHSA-5x8w-8jj5-q52h.
• JPEG issue: CVE-2026-112403.
• Multi-frame memory issue: CVE-2026-96639.
• Python compatibility: Python 3.10 is no longer supported by Pillow 13.0.0.
• Confirmed widespread exploitation: Not established by the cited sources.
• Primary remediation: Upgrade to Pillow 13.0.0 or later and verify production deployment.

Frequently Asked Questions

What is CVE-2026-112900?

CVE-2026-112900 is a Pillow EPS processing vulnerability involving unsafe Ghostscript command-line arguments. Under specific conditions, an attacker-controlled filename can lead to command execution.

Which Pillow versions are affected?

The EPS filename vulnerability affects Pillow versions 2.6.0 through 12.3.0. Version 13.0.0 contains the fix.

Does the attacker need a malicious image?

For CVE-2026-112900, the critical input is the attacker-influenced filename that reaches Ghostscript. Malicious PostScript content is not required for the filename-injection condition.

Does every Python image-upload service have remote code execution?

No. Exposure depends on the affected Pillow version, installed components and whether untrusted input can reach the relevant processing route.

What other vulnerabilities were fixed in Pillow 13.0.0?

The release also addresses serious issues involving FlashPix, JPEG, TIFF, multi-frame image processing, resource exhaustion and additional decoders.

How do I check my Pillow version?

Run python -m pip show Pillow or python -c "import PIL; print(PIL.__version__)" inside the relevant application environment.

Can Python 3.10 applications install Pillow 13.0.0?

No. Pillow 13.0.0 drops Python 3.10 support. Applications must move to a compatible Python runtime to use that release.

Are the Pillow flaws being exploited in the wild?

The cited public reporting does not establish widespread real-world exploitation, although researchers have demonstrated serious effects for some vulnerabilities in controlled tests.

Final Takeaway

Python Pillow 13.0.0 fixes CVE-2026-112900, a Ghostscript argument-injection flaw that can lead to code execution when vulnerable applications process attacker-controlled EPS filenames.

The release also addresses separate image-decoding and memory-corruption weaknesses, some of which have demonstrated code-execution potential.

Organizations should verify their Python and Pillow versions, upgrade affected deployments, rebuild production images and review exposure to untrusted image formats.

The priority is to patch Pillow while confirming that every image-processing workload is using the corrected library and an appropriate security configuration.

Securing Python and other application-server components against code execution?

Our separate Node.js investigation examines how vulnerabilities in widely deployed runtimes can expose applications to memory-safety and networking risks, and why production version verification matters after patching.

Read: Node.js Security Update Fixes 10 Vulnerabilities, Including Brotli RCE →

Official Sources

• Pillow — CVE-2026-112900 Ghostscript Argument Injection Advisory
• Pillow — Version 13.0.0 Official Release Notes
• Pillow — Critical FlashPix Heap Overflow Advisory
• GitHub Security Advisory — CVE-2026-112403 JPEG Buffer Overflow