Attack Chain

1. Attacker crafts a multi-frame image file (PSD, MPO, DCX, or MIC) containing at least two frames.
2. Frame 0 is set to a narrow pixel mode (e.g., L) to trigger allocation of native storage.
3. Frame 1 is crafted with a wider pixel mode (e.g., RGB or CMYK) and the same dimensions as Frame 0.
4. The victim application calls Image.open() on the crafted file.
5. The application iterates to the second frame using ImageSequence.Iterator.
6. The application invokes frame.load() on the second frame.
7. Pillow reuses the native storage buffer from Frame 0 without revalidating the mode/size requirements.
8. The decoder performs an out-of-bounds write to the native buffer, leading to memory corruption or code execution.

Impact

The vulnerability allows for denial-of-service via process crashes. In the MPO/JPEG path, exploitation can lead to native out-of-bounds writes and arbitrary command execution under the context of the user running the Python process. The attack is achievable via a single unauthenticated HTTP request in web applications that process uploaded images using affected Pillow versions.

Recommendation

• Update Pillow to version 13.0.0 or later immediately.
• Audit all internal and public-facing services for the use of PIL.Image and PIL.ImageSequence to process user-supplied image files.
• Implement strict input validation or file-type filtering for image uploads to block potentially malicious multi-frame formats if an immediate upgrade is not feasible.
• Restrict the execution environment of image processing services to minimize the impact of potential command execution (e.g., using containers with minimal privileges, no shells, and restricted file system access).