CVE-2026-112403: Pillow: Heap buffer overflow in ImagingJpegDecode

Should you act?

Critical and remotely reachable

No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 0.3%, percentile 24: FIRST’s model estimates a 0.3% chance of exploitation activity in the next 30 days, higher than 24% of all scored CVEs (low). EPSS is a probability, not a verdict.
• Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
• Only applies if your dependency tree includes Pillow (PyPI) <= 12.3.0, fixed in 13.0.0. Check your lockfile, including transitive dependencies.
• Editorial verdict: Patch this week. Pillow 13.0.0: Critical Image-Parsing Memory Bugs Fixed — If your service opens images that users or the internet supply, move to Pillow 13.0.0 this week; the worst bugs are memory corruption reachable from a crafted file, and reproducers are in the published advisories.

What it is

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can ignore the requested downscaling geometry. An attacker can supply such a JPEG to an application that uses draft() or thumbnail() to request downscaling. This can corrupt heap memory, crash the process, or potentially allow code execution. Older libjpeg-turbo 2.x and IJG builds reject the SOF3 input. This issue is fixed in version 13.0.0.

From the GitHub advisory

Summary

JpegImageFile.draft() — which Image.thumbnail() calls automatically — requests 1/2, 1/4 or 1/8 scaled JPEG output and shrinks self.size and the tile extents to match, so setimage() allocates a single-row decode buffer of ceil(W/s) samples. ImagingJpegDecode() sets cinfo.scalenum/scaledenom, calls jpegstartdecompress(), and then reads scanlines into that buffer without ever comparing cinfo.outputwidth, cinfo.outputheight or cinfo.outcolorcomponents against state->xsize, state->ysize and state->bits.

libjpeg-turbo 3.x decodes lossless (SOF3) JPEG, but hardwires lossless streams to no scaling — the requested scaledenom is silently discarded. It therefore returns full-width W-sample rows into a buffer sized for ceil(W/s). Each jpegreadscanlines() call writes (W - ceil(W/s)) x components bytes past the end of the heap allocation, and the overflowing bytes are the decoded pixel values, which are byte-exact for an 8-bit grayscale lossless image.

The input is a standards-compliant JPEG, so Image.open(..., formats=["JPEG"]) does not prevent it. Pillow's Python SOF parser already accepts marker 0xFFC3 ("SOF3", "Spatial lossless") at 8-bit precision, so the file opens normally as a JPEG / mode L image at its full declared size.

Affected code

Weakness type: CWE-122.

Product: Pillow (PyPI) · Assigned by: GitHub_M · Published: 2026-10-19

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: high (needs special conditions)
• Attack requirements: none
• Privileges required: none (no login)
• User interaction: none

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• FIRST EPSS (model of 2026-10-21): 0.32% probability of exploitation activity in the next 30 days; percentile 24.

Timeline

• 2026-10-16 — erroneo.us brief: Pillow 13.0.0: Critical Image-Parsing Memory Bugs Fixed
• 2026-10-19 — CVE record last updated
• 2026-10-19 — CVE record published by GitHub_M
• 2026-10-20 — GitHub-reviewed advisory GHSA-8g5g-8vmr-9782 published (critical)

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-8g5g-8vmr-9782 github.com
2. CVE.org record CVE-2026-112403 cve.org
3. NVD entry CVE-2026-112403 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. github.com github.com

Critical PyPI advisories · Today’s Security Digest