Pillow: Remote Code Execution and Memory Vulnerabilities
Pillow, a Python image library, contains vulnerabilities that allow for remote code execution or process crashes through the processing of crafted image files or filenames.
CVE search metadata
CVE search record: CVE-2026-112393. EPSS: 0.53%. KEV: no. Brief: Pillow: Remote Code Execution and Memory Vulnerabilities. Brief link: https://feed.craftedsignal.io/briefs/2026-10-pillow-vulnerabilities/
CVE search record: CVE-2026-112403. EPSS: 0.32%. KEV: no. Brief: Pillow: Remote Code Execution and Memory Vulnerabilities. Brief link: https://feed.craftedsignal.io/briefs/2026-10-pillow-vulnerabilities/
CVE search record: CVE-2026-112900. EPSS: 0.43%. KEV: no. Brief: Pillow: Remote Code Execution and Memory Vulnerabilities. Brief link: https://feed.craftedsignal.io/briefs/2026-10-pillow-vulnerabilities/
Triage facts
Revision 1- Evidence
- Not observedHigh confidence
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Oct 23, 10:36 UTC
- Vulnerabilities
- 3 CVEs
- Source quality
- B2Roughly even chance
Pillow contains security vulnerabilities that can be triggered by processing crafted image files or specific filenames. One flaw, CVE-2026-112900, involves the library passing an attacker-controlled filename to Ghostscript when opening EPS images, which can lead to operating system command execution. Other vulnerabilities include memory buffer overflows in JPEG and TIFF processing. Pillow maintainers released version 13.0.0 to address these issues.