Python's Pillow image library has a serious security hole in how it opens EPS files, and the fix is in version 13.0.0, released October 16.

The flaw, CVE-2026-112900, works by passing a filename to Ghostscript, the separate program Pillow runs to render EPS images, without checking it first. Ghostscript can read an attacker-chosen name as instructions rather than a file and point it to a second file carrying commands to run. The weakness is the filename, not the picture: the advisory says a harmless EPS file can still cause damage when an attacker sets its name. That makes upload endpoints that keep or build a stored file's name from user input the realistic target. It only reaches Ghostscript on hosts with the gs program installed, and affects Pillow 2.6.0 through 12.3.0. Maintainers rate it moderate because the attacker must control the filename; GitHub's CVE record scores it 9.2 out of 10.

Pillow is downloaded roughly 436 million times a month, per OX Security, and turns up in web upload forms, avatar and thumbnail tools, document and PDF pipelines, and most machine-learning projects.

Version 13.0.0 is a large security release with fixes across four severity levels, two rated critical by maintainers. None of the flaws is known to be under attack. Two fixes sit in the top critical tier: a memory bug described as stale image data reused after a mode change, and two overflow flaws in JPEG decoding. One JPEG flaw, in FlashPix (FPX), was shown to run an attacker's command from a single Image.open() call on a crafted file if the optional olefile package is installed; Pillow recognizes these files by content, not extension, so a server opening untrusted uploads can be hit with no user action. The other, CVE-2026-112403, overflows a buffer when a program thumbnails a crafted lossless JPEG and reports a crash, not code execution; it was found by Anthropic using Claude and validated manually by Ada Logics. A third flaw, CVE-2026-112393, has been in Pillow since 2013 and overflows a buffer when saving a compressed TIFF to memory rather than disk; reporters crashed the process and only turned it into code execution with a second flaw that leaked memory addresses. Saving to a real file is not affected. GitHub scores the EPS, TIFF and JPEG-thumbnail flaws 9.2 out of 10, though each depends on conditions the score does not carry. CISA's analysts mark no known exploitation for the EPS flaw and a public proof of concept for the TIFF one.

Upgrade with pip install -U "Pillow>=13.0.0" and rebuild containers, wheels or base images bundling an older copy. Pillow 13 drops Python 3.10, so those installs need Python 3.11 or newer. Until upgrading: keep gs off hosts processing untrusted uploads and never pass attacker-controlled filenames to Image.open() for EPS; avoid draft() and thumbnail() on untrusted JPEGs, or call load() first, or pass reducing_gap=None; and treat saving a TIFF to an in-memory buffer like io.BytesIO as sensitive when the image came from a user.

Source: The Hackers News