"The flaw is triggered by the filename, not by anything in the PostScript document," the advisory says.
CVE-2026-112900: EPS filenames can hand an attacker a shell
Pillow, the widely used Python image library, allowed a specially chosen filename for an EPS image to be passed straight to Ghostscript (the gs program) without verification. Ghostscript can interpret that name as instructions and be directed to a second file that carries commands to run, turning what looks like a benign upload into a path for remote code execution. The vulnerability is tracked as CVE-2026-112900 and affects Pillow versions from 2.6.0 through 12.3.0. The maintainers fixed it in Pillow 13.0.0, released on October 16.
Related critical fixes: JPEG, TIFF, and reuse-of-memory bugs
Pillow 13.0.0 is a broad security release covering fixes rated across four severity levels. Two fixes sit in the maintainers' top "critical" tier. One addresses stale image data reused after a mode change; the other closes two overflow flaws in JPEG decoding. One JPEG flaw, in the FlashPix (FPX) format, was shown to run an attacker's command from a single call to Image.open() on a crafted file when the optional olefile package is installed. Pillow recognizes FPX by file content rather than by extension, so servers that open untrusted uploads can be hit with no user action.
Separately, CVE-2026-112403 overflows a memory buffer when a program makes a thumbnail of a crafted lossless JPEG; the advisory reports a crash rather than confirmed code execution. That bug was "found by Anthropic using Claude to study the security of open-source software, validated manually by Ada Logics," according to the advisory. CVE-2026-112393 — a TIFF write-path overflow present since 2013 — can crash a process when saving a compressed TIFF into memory and was converted into code execution only with a second, separate information-leak flaw. In all, the CVE records assigned by GitHub give the EPS, TIFF, and JPEG-thumbnail flaws a 9.2/10 score.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildScope and practical constraints: where the danger actually reaches you
These are not universal "one-click" exploits in every environment. The EPS filename vector only reaches Ghostscript on hosts that have the gs program installed — Pillow needs gs to open EPS at all. The maintainers rate the EPS issue moderate because an attacker must control the filename. The GitHub CVE records, however, label the condition 9.2/10; CISA's analysts mark no known exploitation for the EPS flaw and report a public proof-of-concept for the TIFF issue. The advisory also emphasizes that "the flaw is triggered by the filename, not by anything in the PostScript document," making upload endpoints that preserve or build filenames from user input the realistic targets.
What to do now: upgrade, rebuild, and short-term mitigations
The single clear fix is to upgrade to Pillow 13.0.0 and rebuild any containers, wheels, or base images that bundle older copies. The release drops Python 3.10 support, so environments still on 3.10 must move to Python 3.11 or newer to install the update. The advisory provides the exact pip command:
- pip install -U "Pillow>=13.0.0"
Until upgrades and rebuilds are complete, the maintainers' guidance lists practical mitigations:
- EPS / Ghostscript: keep the gs program off any host that processes untrusted uploads, and never pass an attacker-controlled filename to Image.open() for EPS.
- JPEG thumbnails: avoid draft() and thumbnail() on untrusted JPEGs, or call load() first, or pass reducing_gap=None.
- TIFF: treat saving a TIFF to an in-memory buffer such as io.BytesIO as a sensitive path when the image came from a user.
What this means for web services, machine-learning projects, and container builders
Web applications and APIs that accept image uploads and keep or reconstruct filenames from user input face the most immediate risk from the EPS vector. Machine-learning projects and document-processing pipelines that pull Pillow in as a dependency are exposed indirectly: the advisory notes Pillow "turns up almost everywhere" Python handles images — from web upload forms and avatar tools to PDF pipelines. OX Security's estimate that Pillow is downloaded approximately 436 million times per month underscores how widely distributed copies may be.
Container and image builders must rebuild artifacts that bundle older Pillow releases; simply updating source dependencies without rebuilding containers or wheels leaves vulnerable binaries in place. Until teams rebuild, vulnerable copies will persist in deployed images and CI artifacts.
None of the flaws is known to be under active attack, according to the advisory, but the combination of high CVE scores, proof-of-concept code for some issues, and the library's ubiquity make prompt patching and rebuilds the responsible course. For organizations that cannot upgrade immediately, the mitigations above narrow attack surfaces in the short term; for everyone else, the decisive step is Pillow 13.0.0 and freshly built artifacts.
