Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

A critical vulnerability in the Python Pillow library, CVE-2026-112900, allows remote code execution by exploiting how Pillow handles EPS file names when processing images with Ghostscript. The flaw can be triggered by an attacker-controlled filename, not the file content, making upload endpoints that use user-provided filenames particularly vulnerable. Multiple other critical and high-severity flaws were also patched in Pillow 13.0.0, including memory buffer overflows in JPEG and TIFF processing that could lead to crashes or code execution under certain conditions. These vulnerabilities affect all Pillow versions prior to 13.0.0, which is now required to mitigate the risks.

AI-extracted · verify before operational use