Python apps that accept image uploads need Pillow 13. Two of its fixes stop code execution from a single file

Pillow is the image library behind a huge number of Python web apps: avatar uploads, thumbnails, document converters and media pipelines. Version 13.0.0, released October 16, fixes two bugs its maintainers rate critical.

Both can lead to code execution when an app opens a crafted image file. Pillow picks the decoder from the file’s contents, not its name, so renaming an upload to .jpg does not protect you.

If your Python app makes thumbnails from uploads, one crafted image can run code on that server until Pillow is on 13.0.0.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Pillow 13.0.0 fixes two image bugs that can run code

Pillow 13.0.0 came out on October 16 and its release notes list more than 40 security fixes. Two are rated critical. The first, CVE-2026-112398 (GHSA-5x8w-8jj5-q52h), is a heap overflow in FlashPix JPEG decoding; the advisory includes a proof of concept that runs a command when a single file is passed to Image.open(). It needs the optional olefile package to be installed.

The second (GHSA-v9pv-5gc8-w2m6) lets multi-frame formats such as MPO and PSD reuse an image buffer that is too small for a later frame. The researcher reports building a web upload demo where one unauthenticated request ran a command 10 out of 10 times on Pillow 12.3.0. GitHub’s advisory scores it 9.8.

Python services that open uploaded images

Any service that opens untrusted images with Pillow 12.3.0 or older is in scope. The FlashPix bug affects all versions up to 12.3.0; the multi-frame bug affects 11.0.0 through 12.3.0.

Pillow 13.0.0 drops support for Python 3.10, so apps still on 3.10 cannot take the fix without a Python upgrade.

Upgrade Pillow, or limit which formats your app will open

• Run pip show pillow in each environment and search lockfiles and container images for older pins.
• Upgrade to Pillow 13.0.0 and redeploy the services that process uploads first.
• Until then, uninstall olefile if you do not need FlashPix or MIC files, and pass a formats= list to Image.open() so it accepts only the formats you expect.

Details

• CVE-2026-112398 / GHSA-5x8w-8jj5-q52h: heap buffer overflow in FlashPix JPEG decoding (CWE-122). Affected up to 12.3.0; fixed in 13.0.0.
• GHSA-v9pv-5gc8-w2m6: stale image storage reused across multi-frame mode changes (PSD, MPO, DCX, MIC). Affected 11.0.0 to 12.3.0; CVSS 3.1 9.8 per GitHub.

Hunt / verify

• List hosts and images where olefile is installed next to Pillow.
• Check upload logs for files whose content is OLE2, MPO or PSD while the name says JPEG or PNG.

Source: Pillow 13.0.0 release notes; CVE.org: CVE-2026-112398

Sources

• Pillow: 13.0.0 release notes
• GitHub: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
• GitHub: Pillow multi-frame loaders can reuse stale native image storage after mode transitions
• CVE.org: CVE-2026-112398

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].