CVE-2026-112398
published 2026-10-19CVE-2026-112398: Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix…
PriorityP358critical9.2CVSS 4.0
AVNACHATNPRNUINVCHVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.57%
46.9th percentile
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four components, causing ImagingJpegDecode to write four-component scanlines into the two-byte tile buffer. An attacker can supply a crafted OLE2 FlashPix file to an application with the optional olefile dependency installed that opens or thumbnails untrusted input. This can corrupt heap memory and may allow arbitrary code execution. This issue is fixed in version 13.0.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| python-pillow | pillow | < 13.0.0 | 13.0.0 |
| python | pillow | >= 0 < 13.0.0 | 13.0.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
ghsa·2026-10-23
CVE-2026-112398 [CRITICAL] CWE-122 Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
### Credits
**Researcher**: Alex Bouffard ([email protected])
### Summary
A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with `Image.open()`. The file is recognized by content (the OLE2 magic), not by extension, so any service that opens or thumbnails untrusted uploads with the optional `olefile` dependency installed is reachable with no user interaction. In the PoC below, opening one crafted file executes an attacker-chosen command on stock Pillow 12.2.0 (x86_64 Ubuntu 24.04, glibc 2.39).
### Details
`FpxImagePlugin` decodes FlashPix (FPX) files, which are OLE2/CFBF compou
VulDB
Python Pillow up to 12.x FlashPix JPEG-tile decoder ImagingJpegDecode buffer overflow
vuldb·2026-10-20·CVSS 9.2
CVE-2026-112398 [CRITICAL] Python Pillow up to 12.x FlashPix JPEG-tile decoder ImagingJpegDecode buffer overflow
A vulnerability marked as critical has been reported in Python Pillow Pillow up to 12.x. Impacted is the function ImagingJpegDecode of the component FlashPix JPEG-tile decoder. Performing a manipulation results in buffer overflow.
This vulnerability is cataloged as CVE-2026-112398. It is possible to initiate the attack remotely. There is no exploit available.
It is suggested to upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75https://github.com/python-pillow/Pillow/releases/tag/13.0.0https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x8w-8jj5-q52hhttps://github.com/python-pillow/Pillow/security/advisories/GHSA-5x8w-8jj5-q52h
2026-10-19
Published