Heap Memory Corruption in Pillow Imaging Library Affects Python Applications
CVE-2026-112398

9.2CRITICAL

Key Information:

Vendor

Python-pillow

Status
Pillow
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112398?

Pillow, a widely-used Python imaging library, has a vulnerability in its FlashPix JPEG-tile decoder. Versions prior to 13.0.0 are susceptible to a flaw wherein an attacker can craft a malicious OLE2 FlashPix file. This file can exploit the decoder to write decoded scanlines that exceed the buffer allocation, leading to potential heap memory corruption. Such an issue may inadvertently allow attackers to execute arbitrary code within applications that utilize the Pillow library while processing untrusted input. This vulnerability has been addressed in version 13.0.0, underscoring the importance of keeping essential libraries up to date to mitigate risks.

Affected Version(s)

Pillow < 13.0.0

References

https://github.com/python-pillow/Pillow/security/advisori...
x_refsource_CONFIRM
https://github.com/python-pillow/Pillow/commit/242a059aed...
x_refsource_MISC
https://github.com/python-pillow/Pillow/releases/tag/13.0.0
x_refsource_MISC

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.