Pillow: Heap buffer overflow in JPEG decoder (ImagingJpegDecode)

Summary

Pillow, a Python imaging library, has a heap buffer overflow in its JPEG decoder (ImagingJpegDecode). When an application calls draft() or thumbnail() to request downscaling of a crafted 8-bit lossless (SOF3) JPEG, and Pillow is linked against libjpeg-turbo 3.x, the decoder writes full-width scanlines into a buffer sized for the scaled image. An attacker who can supply such a file can corrupt heap memory, crash the process or potentially execute code. Exploitation requires no authentication but has high complexity.

Affected

• Pillow versions before 13.0.0 (CVE record: affected < 13.0.0; GHSA: <= 12.3.0)
• The exact lower bound of the affected range is unknown; trackers disagree
• Builds linked against libjpeg-turbo 3.x are affected; libjpeg-turbo 2.x and IJG builds reject the SOF3 input

Fixed in

• Pillow 13.0.0 (fix commit 242a059aedc1935097d9aa1dc3f099750467ba75)
• No fix exists in the 12.x line; upgrading requires moving to a new major version (Python 3.10 is no longer supported in Pillow 13)

Workaround

• No vendor-documented workaround found: Unknown.
• Recommended (not vendor-sourced): avoid calling draft() or thumbnail() on untrusted JPEG files until the upgrade is done, and run image processing in an isolated worker with memory limits.

Exploitation

• CISA SSVC: exploitation status 'poc', not automatable.
• A public proof-of-concept repository exists; it has not been verified here.
• No evidence of active exploitation in the wild; not listed as known exploited in the sources reviewed.

Our recommendation

• Check all systems for Pillow versions below 13.0.0, including transitive dependencies in requirements files and lock files.
• Upgrade to Pillow 13.0.0 or later and test the application, since the upgrade may require a newer Python version.
• Where an upgrade is blocked, restrict upload features that process JPEG files, require authentication for them, and avoid thumbnail() or draft() on untrusted input.
• Check internet-facing upload and preview features first.
• Check Linux distribution advisories for backported packages.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  al4n4n/CVE-2026-112403

Research sources

• GitHub Security Advisory GHSA-8g5g-8vmr-9782 github.com
• Pillow 13.0.0 release github.com
• Fix commit 242a059aedc1935097d9aa1dc3f099750467ba75 github.com
• Ubuntu security tracker CVE-2026-112403 ubuntu.com
• Vulners GHSA-8G5G-8VMR-9782 (version range) vulners.com
• Public proof-of-concept repository (not reviewed) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:15.