Pillow 13.0 fixes a command-execution flaw triggered by the filename, not the image

October 16, 2026. Pillow’s maintainers ship version 13.0.0, a security release fixing flaws across four severity levels, two of them rated critical. October 23, 2026. Security firm OX Security documents the most serious one: CVE-2026-112900, a command-execution flaw where the filename, not its content, is passed to Ghostscript. No exploitation is known. Why it matters: Pillow is the most widely used image library in Python, downloaded roughly 436 million times a month, and it turns up in almost every upload form, PDF pipeline and machine-learning project.

The flaw is not in the image, it is in the filename

Pillow opens EPS images by passing the filename to Ghostscript, the separate program it runs to convert the PostScript into pixels. The flaw in CVE-2026-112900 is that this name is not checked before it is handed over. Ghostscript can then read a name chosen by the attacker as an instruction rather than as a file, and point it at a second file that carries the commands to run.

The decisive point is in the advisory itself: “the flaw is triggered by the filename, not by anything in the PostScript document.” In other words, a perfectly harmless EPS file can still do damage once the attacker controls the name it is stored under. Upload endpoints that keep or rebuild a stored file’s name from user input are the realistic target.

The path is only reachable on hosts that have the gs program installed — which Pillow needs to open EPS at all. The flaw affects Pillow from version 2.6.0 up to 12.3.0. The maintainers rate it moderate because the attacker must control the filename; the CVE record published by GitHub rates it 9.2 out of 10.

A 13.0.0 release loaded with critical fixes

13.0.0 is not a single-point fix. It ships two flaws the maintainers place in their top “critical” tier. The first is a memory bug described in the release notes as stale image data reused after a mode change. The second covers two overflows in JPEG decoding.

One of those JPEG flaws, in the FlashPix (FPX) format, was shown to run an attacker’s command from a single call to Image.open() on a crafted file, as long as the optional olefile package is installed. Pillow recognizes these files by their content, not their extension, so a server that opens untrusted uploads can be hit with no user action. The bug was “found by Anthropic using Claude to study the security of open-source software, validated manually by Ada Logics” — part of a wider effort that has already surfaced hundreds of flaws in open-source libraries.

The other, CVE-2026-112403, overflows a memory buffer when a program makes a thumbnail of a crafted lossless JPEG; its advisory reports a crash, not code execution. A third flaw, CVE-2026-112393, has been in Pillow since 2013: it overflows a buffer when a program saves a compressed TIFF to memory rather than to disk — the typical pattern for a service that re-encodes an upload and hands it back. The reporters crashed the process with it, and turned it into code execution only with the help of a second flaw that leaked memory addresses. Saving to a real file on disk is not affected.

Scores that overstate, conditions the score does not carry

The CVE records, assigned by GitHub, rate the EPS, TIFF and JPEG-thumbnail flaws 9.2 out of 10, a critical level. Each depends on conditions the score does not translate — an optional package installed, a controlled filename, an in-memory save. The maintainers’ own ratings for the batch run from moderate to critical. In the CVE records, CISA’s analysts mark no known exploitation for the EPS flaw and a public proof of concept for the TIFF one.

That tension between the score and the real conditions is exactly what a security lead has to judge case by case. A “9.2” flaw on a server that opens EPS files whose names it does not control is a genuine emergency; the same flaw on a service without Ghostscript installed is a theoretical risk.

Verdict

If your Python estate opens user-supplied images — uploads, avatars, thumbnails, PDF pipelines — move to Pillow 13.0.0. It is the only complete fix, and it covers all four severity levels at once. Pillow 13 drops Python 3.10: installs still on 3.10 must first move to Python 3.11 or newer, and rebuild the containers, wheels and base images that bundle an older copy.

If you cannot upgrade right away, apply the per-format workarounds. For EPS: keep the gs program off any host that processes untrusted uploads, and never pass an attacker-controlled filename to Image.open(). For JPEG thumbnails: avoid draft() and thumbnail() on untrusted JPEGs, or call load() first, or pass reducing_gap=None. For TIFF: treat saving to an in-memory buffer such as io.BytesIO as a sensitive path when the image came from a user. And keep the deeper lesson, already documented in our analysis of Anthropic’s bug-hunting tools: an image library’s attack surface is not only the decoder — it is also the filename, the external program it invokes, and the memory path it takes.

References

• The Hacker News — Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
• OX Security — Three Critical Pillow CVEs: RCE and Heap Overflows in Python’s Imaging Library
• Pillow 13.0.0 release notes
• GitHub — Pillow advisory GHSA-w889-685w-c8fh (EPS / Ghostscript)
• CVE.org — CVE-2026-112900