Pillow 13.0.0 security fixes: CVE-2026-112398 FlashPix (FPX) JPEG heap overflow (code execution from one opened file), CVE-2026-112403 JPEG decode overflow, CVE-2026-112393 TIFF save overflow, CVE-2026-96639 multi-frame stale memory, CVE-2026-112900 Ghostscript argument injection. What do I upgrade and how do I protect upload pipelines?

What it is: In October 2026 the Pillow maintainers published several critical advisories, all fixed in Pillow 13.0.0 (released 2026-10-16). The worst, CVE-2026-112398, is a heap buffer overflow in the FlashPix (FPX) plugin's JPEG-tile decoding: simply calling Image.open() and loading a crafted file can run code. Pillow detects FPX by file content, not extension, so any service that opens or thumbnails untrusted uploads is exposed when the optional olefile package is installed. The others: CVE-2026-112403 (heap overflow in JPEG decoding), CVE-2026-112393 (heap overflow when saving TIFF to an in-memory buffer), CVE-2026-96639 (multi-frame loaders reusing stale native image memory after mode changes) and CVE-2026-112900 (EPS files: the file path is passed to Ghostscript unsanitized, so a filename starting with '-' is read as a Ghostscript option). No exploitation in the wild had been reported in the advisories at the time of writing. Am I affected: - Any Pillow (PIL) older than 13.0.0. Ranges per advisory: FPX and JPEG decode up to 12.3.0; TIFF save 2.0.0 to below 13.0.0; Ghostscript 2.6.0 to below 13.0.0; multi-frame 11.0.0 to below 13.0.0. - Check: python -c "import PIL; print(PIL.__version__)" in every environment and container image, or pip show pillow. Pillow is often a transitive dependency (document, ML and imaging libraries), so check lockfiles too. - FPX needs olefile installed (pip show olefile); the EPS issue needs Ghostscript on the system. Fix: 1. Upgrade: pip install -U "pillow>=13.0.0", then rebuild images and redeploy. Note that Pillow 13.0.0 drops Python 3.10, so services on 3.10 need a Python upgrade first; the advisories list 13.0.0 as the first patched version. 2. Until you can upgrade, reduce exposure for untrusted input: pass only the formats you need to Image.open(fp, formats=["PNG", "JPEG", "WEBP"]) (note the JPEG decode issue remains), uninstall olefile if you don't need FPX/MIC, and don't install Ghostscript on servers that don't need EPS. 3. Process untrusted images in a sandboxed, low-privilege worker with no secrets and limited network access, and never pass user-controlled file names directly to Pillow; use generated temp names. 4. If an upload service ran a vulnerable version, review it for unexpected processes or files and rotate credentials it held. Verify: PIL.__version__ reports 13.0.0 or later in every deployed environment, and your dependency scanner no longer flags these CVEs. Sources: https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x8w-8jj5-q52h https://github.com/python-pillow/Pillow/releases/tag/13.0.0 https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html https://nvd.nist.gov/vuln/detail/CVE-2026-112398