If your Python application resizes an avatar, generates a thumbnail or checks an uploaded photo, it is probably using Pillow. The library is the standard way Python code reads and writes images, and, according to The Hacker News, OX Security estimates it at about 436 million downloads a month. That reach is why the project's latest release deserves attention. Pillow 13.0.0, released October 16, 2026, is a large security release. It fixes a group of memory-safety bugs and one argument-injection flaw that, under the right conditions, can lead to command execution.

None of the vulnerabilities is known to have been exploited, according to The Hacker News. The severity ratings are a mess, though, and the risk depends heavily on how a given application uses the library. Here is what was fixed and how to tell whether your systems are exposed.

The headline bug: a filename that acts like a command-line option

The flaw drawing the most attention is CVE-2026-112900, which sits in Pillow's handling of EPS (Encapsulated PostScript) files. Pillow does not render PostScript itself. To open an EPS image it calls Ghostscript, the separate PostScript interpreter, if gs is installed on the host.

According to the NVD record, Pillow passed the caller-supplied filename to Ghostscript without first converting it to a safe absolute path. A filename that starts with a hyphen can therefore be interpreted by Ghostscript as a command-line option rather than a file to open. This is argument injection, a well-known class of bug: the attacker changes how a program behaves by smuggling in flags.

Getting from there to command execution takes more. The NVD description says arbitrary command execution specifically requires a filename beginning with @, which Ghostscript treats as an argument file, plus control of the text file that name references. It adds that the reported chain works with Ghostscript's default -dSAFER invocation. The affected range is long: every release from 2.6.0 up to, but not including, 13.0.0.

Those preconditions explain the dispute over how bad this is. The GitHub-assigned CVSS 4.0 score is 9.2, rated Critical, with a network attack vector, low complexity and an "attack requirements: present" flag. That flag means the attack only works when particular deployment conditions are in place. The Hacker News reports that Pillow's maintainers rate the issue moderate because the attacker has to control the filename, although the 13.0.0 release notes list the EPS advisory (GHSA-w889-685w-c8fh) under their High heading. Both views hold up. An attacker needs Ghostscript on the server and control over the filename Pillow receives. The Hacker News notes the flaw is triggered by the filename, not by anything in the PostScript document, so upload endpoints that keep or build a stored filename from user input are the realistic target.

A TIFF overflow that has been in the code since 2013

The second notable fix is CVE-2026-112393, described in GitHub advisory GHSA-332p-7hrc-92wf. The bug is a heap buffer overflow in _tiffWriteProc, a function in Pillow's C code (src/libImaging/TiffDecode.c). It is triggered when an application saves a TIFF image to an in-memory destination such as Python's io.BytesIO rather than to a file on disk.

Writing to memory is common in web applications, which often build an image in RAM and stream it straight back in an HTTP response. The advisory says anyone who can supply an image to such a service can trigger the bug with default settings, rates it High and lists Pillow 12.3.0 and earlier as affected. The Hacker News reports the flaw has been in Pillow since 2013.

The advisory is careful about impact. Its reproducer crashes the process, and it says code execution is not demonstrated. The Hacker News adds that the reporters turned the overflow into code execution only with the help of a second, separate flaw that leaked memory addresses, and that saving to a real file on disk is not affected. For most deployments the practical risk is a crashed worker, but a heap overflow is the kind of bug that can become worse with enough effort.

A JPEG bug found by an AI model

The third CVE, CVE-2026-112403, is an overflow in thumbnail handling for lossless JPEG images. According to The Hacker News, quoting the advisory, it was found by Anthropic using Claude to study the security of open-source software and validated manually by Ada Logics. The advisory reports a crash, not code execution.

The 13.0.0 release notes list two further fixes in the maintainers' Critical tier. One addresses stale native image storage being reused after an image's mode changes. The other covers JPEG decoder buffer overflows from scanlines wider than tile extents. The Hacker News reports that one of the JPEG flaws, in the FlashPix (FPX) format path, was shown to run an attacker's command from a single Image.open() call on a crafted file, but only when the optional olefile package is installed. Because Pillow recognizes files by content rather than extension, a server that opens untrusted uploads is exposed in that configuration without any user action.

Why the scores don't agree

The Hacker News reports that the CVE records assigned by GitHub score the EPS, TIFF and JPEG-thumbnail flaws 9.2 out of 10, while the maintainers' own ratings for the batch run from moderate to critical. The NVD entry for the EPS bug was published on October 19. The GitHub advisory for the TIFF bug says High, and the maintainers call the EPS bug moderate. Teams that triage by score alone will get confused here. A score describes the worst plausible case, while the maintainers' ratings reflect the conditions an attacker actually needs. For practical purposes, the EPS bug depends on configuration, the TIFF and JPEG-thumbnail bugs are crash bugs reachable through ordinary image handling, and the right response to all of them is the same.

What It Means for Defenders

Who is affected: any application, service or tool that runs Pillow older than 13.0.0. Exposure is highest where Pillow processes images from untrusted sources: user uploads, document converters, thumbnailing services, content-moderation pipelines and machine-learning data ingestion. Pillow is often pulled in as a dependency of something else, so check your dependency trees and container images, not just the requirements files you wrote.

What to patch: upgrade to Pillow 13.0.0, which fixes all of the issues described here. It is a major version bump from 12.3.0 (released July 1, 2026), so test before rolling it out; The Hacker News notes that Pillow 13 drops Python 3.10. That is not a reason to wait long. Rebuild and redeploy container images and frozen environments that bundle an older copy.

For the EPS flaw specifically: the attack needs Ghostscript on the host and an attacker-influenced filename. Until you can upgrade, two defensive questions narrow the exposure. Does this server need Ghostscript at all? And does your code ever pass a user-supplied filename straight to Pillow? Keeping gs off hosts that process untrusted uploads, storing uploads under server-generated names, and restricting which image formats your application will open all reduce exposure to this class of bug.

For the memory-corruption bugs: the confirmed impact for the TIFF and JPEG-thumbnail bugs is crashing the process, so watch for unexplained worker crashes in image-handling services. Treat saving user-supplied TIFFs to an in-memory buffer as a sensitive path until you are patched. Running image processing in isolated, low-privilege workers limits the damage if one of these bugs is ever turned into something worse.

For compliance teams: organizations working through CMMC or similar frameworks should record this as a third-party component vulnerability, log the upgrade in their flaw-remediation records, and confirm their software inventory can actually find Pillow inside the applications they run.

No exploitation has been reported. Pillow runs in a very large share of Python deployments, and the details are now public, so upgrade promptly.

Sources