Pillow: Heap buffer overflow in FlashPix JPEG decoding leads to code execution

Summary

Pillow, the Python imaging library, contains a heap buffer overflow in its FlashPix (FPX) JPEG-tile decoder. A crafted OLE2 FlashPix file can cause decoded image data to be written beyond the allocated tile buffer, which can corrupt heap memory and may allow arbitrary code execution. The flaw is triggered when an application opens untrusted files with Pillow while the optional olefile dependency is installed, for example upload, thumbnailing or conversion services. A public proof of concept exists.

Affected

• Pillow versions before 13.0.0 (GitHub advisory lists affected versions as <= 12.3.0)
• Only installations with the optional olefile dependency are affected by the FPX code path
• Minimum affected version: Unknown.

Fixed in

• Fixed in Pillow 13.0.0
• Upgrade command: pip install -U "Pillow>=13.0.0"
• Pillow 13 requires Python 3.11 or newer.

Workaround

• No official workaround is documented.
• Removing the optional olefile package removes the trigger path, but this is an unverified inference and must be tested first.
• Do not process untrusted uploads in privileged processes; isolate image processing in a minimally privileged container.

Exploitation

• Public proof of concept: Yes, included in the GitHub advisory.
• Known exploitation in the wild: Not reported.
• CISA SSVC: Exploitation poc, automatable no, technical impact total.
• Not listed in CISA KEV.

Our recommendation

• Identify all Pillow installations, including containers, images and transitive dependencies.
• Upgrade to Pillow 13.0.0 or later and rebuild affected containers and bundles.
• Where a downstream package pins Pillow below 13, ask the vendor for a fix and apply interim isolation.
• Check whether olefile is installed and whether it is needed.
• Prioritise internet-facing services that process uploads.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  mcpmark-eval-liuhezi/security-advisory-research

Research sources

• GHSA-5x8w-8jj5-q52h Security Advisory github.com
• Pillow 13.0.0 Release github.com
• Fix commit 242a059 github.com
• Pillow 13.0.0 Release Notes pillow.readthedocs.io
• GitLab Advisory Database entry advisories.gitlab.com
• Strix CVE summary www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:14.