CVE-2026-112398: CWE-122: Heap-based Buffer Overflow in python-pillow Pillow

Pillow, a Python imaging library, contains a heap-based buffer overflow vulnerability (CWE-122) in its FlashPix JPEG-tile decoder in versions prior to 13.0.0. The vulnerability arises because the decoder selects raw mode LA with two bytes per pixel, but an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four components. This mismatch causes the ImagingJpegDecode function to write four-component scanlines into a two-byte tile buffer, leading to heap corruption. An attacker can exploit this by supplying a crafted OLE2 FlashPix file to an application that uses Pillow with the optional olefile dependency installed to open or thumbnail untrusted input. This vulnerability is addressed and fixed in Pillow version 13.0.0.

Exploitation of this vulnerability can lead to heap memory corruption and may allow an attacker to execute arbitrary code on the affected system. The CVSS 4.0 score is 9.2, indicating a critical severity with network attack vector, high complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability.

Upgrade to Pillow version 13.0.0 or later, where this heap-based buffer overflow vulnerability in the FlashPix JPEG-tile decoder is fixed. No other mitigation steps are indicated by the vendor advisory.