Pillow 13.0.0 Fixes Two Maintainer-Rated Critical Flaws and an EPS Filename Bug, CVE-2026-112900, That Can Reach Ghostscript Command Execution
Pillow 13.0.0, released October 16, fixes 40 advisories published October 17, including two rated critical and an EPS filename argument injection in the Ghostscript call.
Overview
Pillow, the Python imaging library, shipped version 13.0.0 on October 16 with fixes for a large batch of security advisories. According to The Hacker News, none of the flaws is known to be under attack. The GitHub release page was published at 22:37 UTC that day, and the project’s advisory list shows 40 advisories published on October 17 that name 13.0.0 as the patched version. Two of them carry GitHub’s critical severity label.
The EPS filename flaw
The best-known item is CVE-2026-112900, which GitHub’s advisory GHSA-w889-685w-c8fh describes as an argument injection in the Ghostscript call that Pillow makes when it opens EPS images. The advisory says a filename beginning with - is interpreted by Ghostscript as an option, and that a filename of the form @<path> makes Ghostscript read additional command-line arguments from the named file. If the attacker can additionally control the referenced file, the advisory says, this “can be escalated to arbitrary command execution,” which the reporter verified by executing id.
The advisory states that “the flaw is triggered by the filename, not by anything in the PostScript document.” It applies under Pillow’s default configuration, with Ghostscript’s -dSAFER enabled, and the advisory names file-upload endpoints that preserve or derive the stored name from user input as a realistic precondition. It lists Pillow 2.6.0 through 12.3.0 as affected and 13.0.0 as patched. The 13.0.0 release notes list the corresponding change as “Transform EPS file name to an absolute path before invoking Ghostscript.”
The severity differs by source. The GitHub advisory carries a medium severity label, and The Hacker News reports that the maintainers rate it moderate because the attacker has to control the filename, while the CVE record assigned by GitHub rates it 9.2 out of 10. The same outlet notes the flaw only reaches Ghostscript on hosts that have the gs program installed.
The two critical-rated advisories
The advisory list marks two flaws as critical. One is CVE-2026-96639, which GHSA-v9pv-5gc8-w2m6 titles “Pillow multi-frame loaders can reuse stale native image storage after mode transitions.” It lists a CVSS 3.1 score of 9.8 and affected versions from 11.0.0 through 12.3.0. The reporter wrote that, “In the MPO/JPEG path, I also demonstrated command execution in matching Python/Pillow runtime profiles.”
The other is CVE-2026-112398, which GHSA-5x8w-8jj5-q52h describes as a heap buffer overflow in FlashPix (FPX) JPEG decoding that leads to code execution. According to the advisory, any service that opens or thumbnails untrusted uploads with the optional olefile dependency installed is reachable, and the file is recognized by its content rather than its extension. The advisory’s proof of concept executes an attacker-chosen command on stock Pillow 12.2.0.
Other high-severity items
GHSA-8g5g-8vmr-9782 covers CVE-2026-112403, a high-severity heap buffer overflow in JPEG decoding reachable through Image.thumbnail(), which calls draft() automatically. The advisory says the issue “was found by Anthropic using Claude to study the security of open-source software, validated manually by Ada Logics.”
GHSA-332p-7hrc-92wf covers CVE-2026-112393, a high-severity heap overflow in _tiffWriteProc when saving a TIFF to an in-memory object such as BytesIO. The advisory says the defect was introduced in a 2013 commit and first released in Pillow 2.0.0, and that the attached reproducer crashes the process. The Hacker News adds that saving to a real file on disk is not affected.
Upgrade notes
The Hacker News cites OX Security as estimating that Pillow is downloaded about 436 million times a month, and recommends upgrading with pip install -U "Pillow>=13.0.0". The release drops Python 3.10 support, so installs on that version need Python 3.11 or newer, according to the same outlet and the release notes. Until upgrading, the outlet lists keeping the gs program off hosts that process untrusted uploads and avoiding draft() and thumbnail() on untrusted JPEGs as mitigations.
What We Don’t Know
The sources do not report any exploitation in the wild. The 9.2 score for CVE-2026-112900 comes from The Hacker News’s reading of the CVE record, and this article did not independently confirm it against the National Vulnerability Database. The advisory list is also still moving: GHSA-654x-cwwv-5j9c, published October 19, covers an Arrow export memory leak when PILLOW_ALIGNMENT is above 1, and lists no patched version.