Pillow’s October 16 update fixes image-processing security flaws
Pillow 13.0.0 fixes flaws that can allow command execution or crashes under specific conditions. Updating also requires Python 3.11 or newer.
Loading… Բեռնվում է…
Pillow 13.0.0 fixes flaws that can allow command execution or crashes under specific conditions. Updating also requires Python 3.11 or newer.
Pillow, a Python library used to open and process images, released version 13.0.0 on October 16, 2026, fixing flaws that can let attackers run commands or crash a service under specific conditions. The Hacker News detailed the attack paths in its October 23 report. Services that accept image uploads are among the systems affected, but exposure depends on how they open, resize or save those images.
One flaw affects Pillow versions 2.6.0 through 12.3.0 and can be triggered by an attacker-controlled filename rather than malicious image contents. Other flaws involve opening a specially crafted file, making a thumbnail or saving an image to memory. None was known to be under attack as of the October 23 report.
The reported outcomes differ. Some researchers demonstrated command execution; other tests produced crashes. Several flaws involve a buffer overflow, where a program writes beyond the memory space reserved for data.
| Processing path | Required conditions | Reported outcome |
|---|---|---|
| EPS opening — CVE-2026-112900 | Ghostscript’s gs program is installed, and the attacker controls the filename passed to Pillow. | Ghostscript can interpret the filename as instructions pointing to a second file containing commands to run. |
| FlashPix (FPX) opening |
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
| The optional olefile package is installed, and the application opens a crafted file with Image.open(). |
| A JPEG-decoding overflow was shown to execute an attacker’s command from that single call. |
| JPEG thumbnail creation — CVE-2026-112403 | The application makes a small preview image from a crafted lossless JPEG. | The advisory reports a buffer overflow causing a crash, not code execution. |
| TIFF saving — CVE-2026-112393 | The application saves a compressed TIFF to memory rather than a file on disk. | Researchers caused a crash and achieved code execution only by combining it with a separate flaw that exposed memory addresses. Saving to a real disk file is unaffected. |
For EPS images, Pillow passes the filename to Ghostscript, a separate program that turns the image into pixels. Upload services that preserve filenames supplied by users, or build stored filenames from user input, are the realistic targets described in the report. Even a harmless EPS document can trigger the flaw if its filename is attacker-controlled.
For FPX files, changing the file extension does not remove the risk: Pillow recognizes the format from its contents. With olefile installed, a server opening an untrusted upload can trigger the attack without further user action. The TIFF flaw, present since 2013, affects a different workflow: services that re-encode an uploaded image in memory before returning it.
The GitHub-assigned vulnerability records rate the EPS, TIFF and JPEG-thumbnail flaws at 9.2 out of 10, or critical. Pillow’s maintainers rate the EPS flaw moderate because an attacker must control the filename. Their ratings for the release range from low to critical, with the JPEG overflow fixes in the critical tier. A separate fix for reusing stale image data after a mode change also falls in that top tier, according to the report.
The report describes a public proof of concept for the TIFF flaw—a demonstration of the attack. That is distinct from evidence that attackers are exploiting it against deployed systems.
The Hacker News advises upgrading to Pillow 13.0.0 and rebuilding containers, wheel packages and base images that bundle older copies. Pillow 13 no longer supports Python 3.10, so deployments using that version must also move to Python 3.11 or newer.
Until the upgrade is possible, Pillow’s security guidance and the advisories, as relayed by The Hacker News, identify these precautions:
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min