CVE-2026-112403: CWE-122: Heap-based Buffer Overflow in python-pillow Pillow
Description
A heap-based buffer overflow vulnerability exists in the Pillow Python imaging library prior to version 13.0.0. The issue occurs in the JPEG decoder when processing certain 8-bit lossless SOF3 JPEG images with libjpeg-turbo 3.x, where requested downscaling is ignored, leading to buffer overflow. This can cause heap corruption, application crashes, or potentially allow code execution. The vulnerability is fixed in Pillow version 13.0.0.
CVSS v4.0
Score 9.2critical
Affected software
python-pillow
Pillow
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Pillow versions before 13.0.0 contain a heap-based buffer overflow in the JPEG decoder. When using draft() or thumbnail() methods to request downscaling, the ImagingJpegDecode function does not verify the actual output width and component count after scaling. Specifically, an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can bypass the requested downscaling, causing a full-width scanline to be written into a smaller buffer. Older libjpeg-turbo 2.x and IJG builds reject this SOF3 input, mitigating the issue. This vulnerability can corrupt heap memory, crash the process, or potentially allow arbitrary code execution. The issue is resolved in Pillow 13.0.0.
Potential Impact
An attacker can supply a crafted JPEG image that triggers a heap-based buffer overflow when processed by vulnerable Pillow versions. This can lead to heap corruption, application crashes, and potentially arbitrary code execution without requiring user interaction or privileges. The CVSS 4.0 score is 9.2 (critical), indicating a high-impact remote vulnerability with high complexity and no required privileges.
Mitigation Recommendations
Upgrade to Pillow version 13.0.0 or later, where this vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed fixed in version 13.0.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-19T16:58:51.959Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad6906e2cdf04f656950189
Added to database: 10/19/2026, 21:49:34 UTC
Last enriched: 10/19/2026, 22:03:22 UTC
Last updated: 10/19/2026, 22:08:16 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.