CVE-2026-112403: Pillow Heap Buffer Overflow in ImagingJpegDecode
Summary
CVE-2026-112403: Pillow: Heap buffer overflow in ImagingJpegDecode. Affects pillow versions < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pillow is a widely used Python Imaging Library that adds image processing capabilities to your Python interpreter. It supports opening, manipulating, and saving many different image file formats. This library is essential for developers working with images in Python applications. However, a critical vulnerability has been identified in its JPEG decoding functionality, specifically in the handling of lossless JPEG images, which can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from a heap buffer overflow in the ImagingJpegDecode function of the Pillow library. When the draft method is called, it improperly allocates a buffer for decoded JPEG scanlines without validating the dimensions of the image against the allocated buffer size. This oversight allows an attacker to craft a specially formatted JPEG image that, when processed, can lead to memory corruption and potentially execute arbitrary code. The vulnerability is particularly dangerous as it can be triggered by standard-compliant JPEG files, making it difficult to mitigate through input validation alone.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the Image.thumbnail() method on JPEG images that may be encoded in lossless format. Instead, consider using other methods such as Image.resize() or loading the image with Image.open() followed by im.load() before any thumbnail operations.
Conclusion
The CVE-2026-112403 vulnerability in the Pillow library poses a significant risk due to a heap buffer overflow in its JPEG decoding functionality. It is crucial for developers to update to the latest version of Pillow to protect their applications from potential exploitation. By following the recommended steps and utilizing available resources like Vulert, developers can ensure their software remains secure.
See every vulnerability recorded for pillow →
FAQ
CVE-2026-112403 is a critical vulnerability in the Pillow library that allows for a heap buffer overflow when processing certain JPEG images.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities in real-time.
Exploiting this vulnerability can lead to memory corruption, arbitrary code execution, and potentially compromise the security of the application using the Pillow library.
Yes, a patch is available in Pillow version 13.0.0 and later. It is recommended to upgrade to this version to mitigate the vulnerability.
If you cannot upgrade immediately, avoid using the Image.thumbnail() method on potentially vulnerable JPEG images as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
