Pillow 13.0.0 Closes a Ghostscript Filename Injection That Turns a Crafted EPS Upload Into Code Execution — Plus Buffer Overflows in TIFF, JPEG and FlashPix, One Found by Anthropic's Claude
Pillow 13.0.0 Closes a Ghostscript Filename Injection That Turns a Crafted EPS Upload Into Code Execution — Plus Buffer Overflows in TIFF, JPEG and FlashPix, One Found by Anthropic's Claude
CVE-2026-112900 lives in an unusual place: not in the image data, but in the file's name. Pillow, the most widely used image library for Python, opens EPS images by passing the file's name to Ghostscript — the separate program it runs to turn the image into pixels — without checking the name first. Ghostscript can read an attacker-chosen filename as instructions and point it at a second file carrying commands to run, turning a routine Image.open() into operating system command execution. The maintainers fixed it in Pillow 13.0.0, released October 16; the flaw reaches back to version 2.6.0, meaning every release for over a decade is affected. "The flaw is triggered by the filename, not by anything in the PostScript document," the advisory notes — a harmless EPS file still causes damage when the attacker controls what it gets called.
The scale of exposure is the reason this one matters. OX Security, whose report drew attention to the release, estimates Pillow is downloaded about 436 million times a month — web upload forms, avatar and thumbnail pipelines, PDF processing, and most machine-learning projects pull it in. The realistic target is an upload endpoint that keeps or builds a stored file's name from user input, which is exactly the pattern countless applications ship. The maintainers rate the EPS flaw moderate — the attacker has to control the filename — while GitHub's CVE record scores it 9.2 critical; the bug only reaches Ghostscript on hosts with the gs program installed, which Pillow requires to open EPS files at all.
Version 13.0.0 is a large security release beyond the headline flaw, with fixes across four severity levels — two rated critical by the maintainers, none known to be under attack. One critical fix covers two overflow flaws in JPEG decoding: in the FlashPix (FPX) format, a crafted file was shown to run an attacker's command from a single Image.open() call, as long as the optional olefile package is installed — and because Pillow recognizes files by their content rather than their extension, a server that opens untrusted uploads is hit with no user action. Its sibling, CVE-2026-112403, overflows a memory buffer when a program thumbnails a crafted lossless JPEG — a crash, not code execution — and carries a striking provenance: "found by Anthropic using Claude to study the security of open-source software, validated manually by Ada Logics." A third flaw, CVE-2026-112393, has been in Pillow since 2013: a buffer overflow when saving a compressed TIFF to memory rather than disk — the common pattern for services that re-encode an upload and hand it back — where the reporters achieved code execution only by chaining a second, separate memory-address leak. The CVE records score the EPS, TIFF, and JPEG-thumbnail flaws 9.2; CISA's analysts mark a public proof-of-concept for the TIFF one.
What Should You Do?
- Upgrade to Pillow 13.0.0 and rebuild everything that bundles it — containers, wheels, and base images. Pillow 13 drops Python 3.10, so pinned environments still on 3.10 need Python 3.11 or newer as well:
pip install -U "Pillow>=13.0.0". - Keep Ghostscript off hosts that process untrusted uploads — without
gsinstalled the EPS path is dead — and never pass an attacker-controlled filename toImage.open()for EPS files. - Avoid
draft()andthumbnail()on untrusted JPEGs — or callload()first, or passreducing_gap=None— until every consumer of the image is on 13.0.0. - Treat in-memory TIFF saves as a sensitive path — writing a compressed TIFF to an
io.BytesIOfrom a user-supplied image is the exact shape of CVE-2026-112393; saving to a real file on disk is not affected.
The WAF Angle
Two of these flaws defeat the checks defenders most often rely on. The EPS flaw is triggered by the filename — a string a WAF can absolutely validate at the edge, but only if upload endpoints actually pass filenames through a policy rather than storing whatever the client sent, the same input-trust failure behind the Bricksforge arbitrary-file-upload chain. The FlashPix flaw is worse for content inspection: Pillow reads files by magic bytes, not extension, so an upload that looks like a JPEG to your content-type check can be an FPX image to the parser — no user action required past the upload. Image pipelines have been productive RCE ground all year, from the Next.js image-optimization flaw to libheif's decode bugs — and the lesson each time is the same: the parser is the perimeter, so validate everything it touches and keep the library patched.
