CVE-2026-112403 in Pillow
Summary
by MITRE • 10/20/2026
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can ignore the requested downscaling geometry. An attacker can supply such a JPEG to an application that uses draft() or thumbnail() to request downscaling. This can corrupt heap memory, crash the process, or potentially allow code execution. Older libjpeg-turbo 2.x and IJG builds reject the SOF3 input. This issue is fixed in version 13.0.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in Pillow versions prior to 13.0.0 represents a critical memory safety flaw within its JPEG decoding subsystem, specifically affecting how image data is handled during downscaling operations. Pillow serves as a foundational imaging library for Python applications, and this defect arises from an improper interaction between the application-level draft scaling logic and the underlying libjpeg-turbo decoder. When an application utilizes methods such as draft() or thumbnail(), it requests that the JPEG be decoded at a reduced resolution to optimize performance or fit specific display constraints. However, the internal function ImagingJpegDecode fails to adequately verify the actual output dimensions and component count returned by libjpeg after this scaling request is processed. This lack of validation creates a discrepancy between the buffer size allocated for the scaled image and the actual amount of data written by the decoder, leading to severe memory corruption risks.
The technical root cause lies in the handling of 8-bit lossless SOF3 JPEGs when decoded using builds linked against libjpeg-turbo version 3.x or later. In these specific configurations, an attacker can craft a malicious JPEG file that exploits this validation gap by ignoring the requested downscaling geometry. Instead of adhering to the smaller dimensions specified for the draft scale, the decoder writes a full-width scanline into a buffer that was sized only for the reduced resolution. This mismatch results in a heap-based buffer overflow, where data is written beyond the allocated boundaries of the destination memory region. Older versions of libjpeg-turbo (2.x) and Independent JPEG Group builds are not susceptible to this specific exploitation path as they inherently reject such malformed SOF3 inputs during parsing, thereby preventing the overflow from occurring in those environments.
The operational impact of this vulnerability is severe, ranging from application instability to complete system compromise. The immediate consequence of writing beyond buffer boundaries is heap memory corruption, which can manifest as data integrity issues or unpredictable behavior within the hosting process. In many cases, this leads to a denial of service condition where the process crashes due to segmentation faults or other fatal exceptions triggered by accessing invalid memory addresses. More critically, because modern operating systems employ various mitigations that do not fully prevent all forms of heap exploitation, an attacker with control over the input JPEG file may leverage this buffer overflow to achieve arbitrary code execution. By carefully crafting the payload within the overflowing data, it is possible to overwrite function pointers or return addresses on the heap, allowing for remote code execution if the vulnerable Pillow library processes untrusted images from external sources such as web uploads or email attachments.
From a classification perspective, this vulnerability aligns with CWE-120, which denotes Buffer Copy without Checking Size of Input, and more specifically CWE-787, Out-of-bounds Write. The exploitation technique involves manipulating input data to trigger memory corruption during image processing, which maps to the ATT&CK tactic of Initial Access via Tainted External Software or Component if delivered through a web service, followed by Execution techniques that leverage heap spraying or structure overwrite methods common in modern exploit development. Security researchers and developers should note that this issue is not limited to simple display errors but represents a fundamental failure in input validation within the image decoding pipeline.
To mitigate this risk, organizations relying on Pillow must immediately upgrade to version 13.0.0 or later, where the vulnerability has been patched by enforcing strict verification of libjpeg's output dimensions against the requested draft scale before buffer allocation and writing occur. For applications that cannot yet update their dependencies, implementing a temporary workaround involves validating image properties using alternative libraries such as OpenCV or standard file header checks before passing them to Pillow for processing. Additionally, deploying runtime application self-protection tools or memory safety wrappers can help detect abnormal heap writes in production environments, although upgrading the library remains the only definitive remediation strategy.