Log in / Sign up

Vulnerability details

CVE-2026-112403

python-pillow Pillow

Pillow: Heap buffer overflow in ImagingJpegDecode

CVSS 4.0
9.2Critical

Official description

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can ignore the requested downscaling geometry. An attacker can supply such a JPEG to an application that uses draft() or thumbnail() to request downscaling. This can corrupt heap memory, crash the process, or potentially allow code execution. Older libjpeg-turbo 2.x and IJG builds reject the SOF3 input. This issue is fixed in version 13.0.0.

CVSS scores

ScoreVersionSourceVector
9.2Critical 4.0 CVEProject cvelistV5 (CNA) (GitHub_M) CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

VendorProductVersionsSource
python-pillow Pillow < 13.0.0 CVEProject cvelistV5 (CNA)

References and advisories

3
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-10-20
Last updated
2026-10-23
State
Published
Assigner (CNA)
GitHub_M
Kolun priority
29 · Low

Exploit prediction (EPSS)

0.94%
Probability of exploitation in 30 days
61.2%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
Proof of concept
Technical impact
Total

Weaknesses (CWE)

  • CWE-122
    Heap-based Buffer Overflow