{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Pillow: heap buffer overflow in FlashPix (FPX) JPEG decoding lets one crafted image run code (CVE-2026-112398) · updates",
  "home_page_url": "https://pwn.watch/i/pillow-fpx-heap-overflow-cve-2026-112398",
  "feed_url": "https://pwn.watch/i/pillow-fpx-heap-overflow-cve-2026-112398/feed.json",
  "description": "A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker run code by getting an application to open a single crafted file with Image.open(). Pillow detects FPX files by their OLE2 content, not their extension, so any service that opens or thumbnails untrusted uploads with the optional olefile package installed can be hit with no user interaction. The advisory includes a working proof of concept (shown on Pillow 12.2.0 with ASLR disabled). Pillow 12.3.0 and earlier are affected; upgrade to 13.0.0. GitHub rates it critical (CVSS 4.0 score 9.2).",
  "language": "en",
  "_pwn": {
    "slug": "pillow-fpx-heap-overflow-cve-2026-112398",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/pillow-fpx-heap-overflow-cve-2026-112398/feed.xml",
    "llms": "https://pwn.watch/i/pillow-fpx-heap-overflow-cve-2026-112398/llms.txt",
    "json": "https://pwn.watch/i/pillow-fpx-heap-overflow-cve-2026-112398.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/pillow-fpx-heap-overflow-cve-2026-112398#2026-10-23-de2ccad1",
      "url": "https://pwn.watch/i/pillow-fpx-heap-overflow-cve-2026-112398#2026-10-23-de2ccad1",
      "title": "Pillow: heap buffer overflow in FlashPix (FPX) JPEG decoding lets one crafted image run code (CVE-2026-112398): Pillow publishes GHSA-5x8w-8jj5-q52h (CVE-2026-112398) with a proof of concept; the fix ships in Pillow 13.0.0.",
      "content_text": "Pillow: heap buffer overflow in FlashPix (FPX) JPEG decoding lets one crafted image run code (CVE-2026-112398): Pillow publishes GHSA-5x8w-8jj5-q52h (CVE-2026-112398) with a proof of concept; the fix ships in Pillow 13.0.0.\n\nSource: https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x8w-8jj5-q52h",
      "date_published": "2026-10-23T00:00:00.000Z",
      "external_url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x8w-8jj5-q52h",
      "tags": [
        "critical"
      ]
    }
  ]
}