Pillow: heap buffer overflow in FlashPix (FPX) JPEG decoding lets one crafted image run code (CVE-2026-112398)
Pillow (Python imaging library)
A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker run code by getting an application to open a single crafted file with Image.open(). Pillow detects FPX files by their OLE2 content, not their extension, so any service that opens or thumbnails untrusted uploads with the optional olefile package installed can be hit with no user interaction. The advisory includes a working proof of concept (shown on Pillow 12.2.0 with ASLR disabled). Pillow 12.3.0 and earlier are affected; upgrade to 13.0.0. GitHub rates it critical (CVSS 4.0 score 9.2).
Why this severity: CVSS 4.0 9.2 per GitHub; only reachable when the optional olefile package is installed
- Started
- Oct 23, 2026
Affected
- pillow <= 12.3.0
Fixed in
- pillow 13.0.0
Timeline1
Advisories4
Get an email when a new major security incident drops. No spam, unsubscribe any time.
