Buffer Overflow in Pillow's JPEG Decoder Affects Python Imaging Library

CVE-2026-112403

What is CVE-2026-112403?

Pillow, a widely used Python imaging library, is susceptible to a buffer overflow vulnerability within its JPEG decoding functionality. This security flaw occurs in versions prior to 13.0.0, where the JPEG decoder fails to verify the actual output width and component count after a scaling request. An attacker can exploit this vulnerability by supplying a specially crafted JPEG image that can corrupt heap memory, potentially leading to application crashes or arbitrary code execution when functions like draft() or thumbnail() are utilized. The issue has been rectified in version 13.0.0 of Pillow, and users are advised to upgrade to mitigate their exposure to this vulnerability.

References