CVE-2026-112403

Analyzed Analyzed - Analysis Complete

Pillow JPEG Decoder Heap Corruption via SOF3

Publication date: 2026-10-19

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can ignore the requested downscaling geometry. An attacker can supply such a JPEG to an application that uses draft() or thumbnail() to request downscaling. This can corrupt heap memory, crash the process, or potentially allow code execution. Older libjpeg-turbo 2.x and IJG builds reject the SOF3 input. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-27

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-112403

Affected Vendors & Products

Vendor	Product	Version / Range
python	pillow	to 13.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

Pillow before 13.0.0 has a flaw in its JPEG decoder where it can write a full-width scanline into a buffer sized for downscaled output. This happens because the decoder does not verify the actual output width or component count after scaling is requested. An attacker can exploit this by providing a specially crafted JPEG file to an application using draft() or thumbnail() functions, leading to heap memory corruption, crashes, or potential code execution.

Detection Guidance

Detection involves checking for vulnerable versions of Pillow and inspecting JPEG processing in applications. Use 'pip show Pillow' to check the installed version. If it's below 13.0.0, the system is vulnerable. Review application code for use of draft() or thumbnail() methods with JPEG inputs.

Impact Analysis

This vulnerability can impact you by causing application crashes, corrupting data, or allowing attackers to execute arbitrary code on your system. If you use Pillow to process JPEG images with downscaling, an attacker could exploit this to compromise your application or system.

Compliance Impact

This vulnerability could potentially lead to unauthorized code execution or memory corruption when processing malicious JPEG images. For GDPR, this may impact data integrity and security requirements under Articles 32 and 5. For HIPAA, it could compromise protected health information integrity and availability if exploited in healthcare applications.

Mitigation Strategies

Upgrade Pillow to version 13.0.0 or later to address the vulnerability. If using libjpeg-turbo 3.x, ensure the application does not process SOF3 JPEG files with draft() or thumbnail() functions until updated.

Hi! I’m here to help you understand CVE-2026-112403. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...