Critical Pillow Image Library Flaw Allows Code Execution via Crafted EPS Filename

Vulnerability Details

Pillow, the most widely used image library for Python, contains a critical flaw in its EPS handling. When opening an EPS file, Pillow passes the file name to the Ghostscript program without validation. An attacker who controls the file name can cause Ghostscript to interpret the name as commands, leading to arbitrary code execution. The vulnerability is tracked as CVE-2026-112900 and affects Pillow versions 2.6.0 through 12.3.0. The maintainers released version 13.0.0 on October 16 to address the issue.

The advisory states that the flaw is triggered by the filename, not by anything in the PostScript document, meaning a harmless EPS file can become dangerous when the name is manipulated. The flaw only triggers on systems that have the gs program installed, which is required for EPS support.

Impact and Scope

Pillow is used in web upload forms, avatar and thumbnail generation, document and PDF pipelines, and most machine learning projects. OX Security estimates the library is downloaded about 436 million times per month. Version 13.0.0 is a large security release that includes fixes across four severity levels, two of which are rated critical by the maintainers. The CVE record rates the EPS flaw at 9.2 out of 10, while the maintainers rate it moderate because the attacker must control the file name. No exploitation of the EPS flaw has been observed in the wild.

Additional critical fixes in the same release address a memory reuse bug after a mode change, two JPEG decoding overflows, and a long-standing TIFF buffer overflow present since 2013. The JPEG overflow in the FlashPix format can achieve code execution with a single call to Image.open when the optional olefile package is installed. The TIFF overflow occurs when saving a compressed TIFF to an in-memory buffer such as io.BytesIO, a common pattern for services that re-encode uploads.

Mitigation Steps

Upgrade to Pillow 13.0.0 and rebuild any containers, wheels, or base images that bundle an older copy. Pillow 13 drops support for Python 3.10, so environments still on 3.10 must move to Python 3.11 or newer. The upgrade command is pip install -U "Pillow>=13.0.0".

If immediate upgrade is not possible, the following mitigations reduce risk: keep the gs program off hosts that process untrusted uploads and never pass an attacker controlled file name to Image.open for EPS files; avoid using draft() and thumbnail() on untrusted JPEGs, or call load() first, or pass reducing_gap=None; treat saving a TIFF to an in-memory buffer as a sensitive operation when the image originates from a user.

Sources: The Hacker News