Pillow 13.0.0 fixes EPS filename and image-processing flaws

Pillow has released version 13.0.0 to fix a set of security vulnerabilities, including CVE-2026-112900, an EPS image-processing flaw that can allow operating-system command execution through an attacker-controlled filename. The issue affects Pillow versions 2.6.0 through 12.3.0 and is relevant to servers that process untrusted image uploads.

The Python image library is widely used in upload forms, avatar and thumbnail services, document and PDF processing, and machine-learning projects. OX Security estimates that Pillow is downloaded about 436 million times each month, making remediation significant for teams that embed image handling in web services and automated workflows.

EPS filename reaches Ghostscript

The EPS weakness is not triggered by malicious content inside a PostScript document. Instead, Pillow passes the name of an EPS file to Ghostscript when rendering it, and a filename selected by an attacker can be interpreted as instructions that direct Ghostscript to another file containing commands.

This path is available only when the gs Ghostscript program is installed, because Pillow requires it to open EPS files. The practical exposure is therefore greatest at upload endpoints that retain a user-supplied name or derive the stored filename from user-controlled input. Pillow rates the issue as moderate because the attacker must control that name, while the GitHub-assigned CVE record assigns it a 9.2 score.

Other critical fixes in the release

Version 13.0.0 contains fixes across four severity levels, with two issues in Pillow's critical tier. One addresses stale image data that can be reused after a mode change. Another set covers overflow flaws in JPEG decoding.

One JPEG issue involves FlashPix files and can execute an attacker command from a single call to Image.open() on a crafted file when the optional olefile package is installed. Pillow identifies these files from their contents rather than their extension, so changing an upload's filename extension does not prevent that code path. The release also fixes CVE-2026-112403, a buffer overflow when an application creates a thumbnail from a crafted lossless JPEG; its advisory reports a crash rather than code execution.

Anthropic found the JPEG thumbnail issue using Claude to examine open-source software, and Ada Logics manually validated it. Pillow 13.0.0 also fixes CVE-2026-112393, a TIFF issue present since 2013. It occurs when a service saves a compressed TIFF supplied by a user to an in-memory buffer such as io.BytesIO; saving to a file on disk is not affected. Researchers reported a crash and achieved code execution only by combining it with a separate address-leak flaw.

Upgrade and reduce exposure

Pillow advises upgrading to version 13.0.0 and rebuilding containers, wheels and base images that package an earlier release. Teams should note that Pillow 13 no longer supports Python 3.10, so installations on that version need Python 3.11 or later before the upgrade.

Until upgrades are complete, organizations can keep Ghostscript off hosts that process untrusted uploads and avoid passing attacker-controlled EPS filenames to Image.open(). They can also avoid draft() and thumbnail() on untrusted JPEGs, call load() first or use reducing_gap=None, and treat in-memory TIFF re-encoding as a sensitive path. The immediate business implication is to inventory every image-processing deployment, update its packaged Pillow version, and apply the relevant temporary controls where untrusted files are handled.