CVE-2026-112403
9.2CriticalPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-122
Impact
Remote attackers can crash processes or potentially execute arbitrary code by supplying a malicious JPEG to services that downscale images. This requires no authentication, just an endpoint accepting JPEGs that calls draft() or thumbnail().
Root cause
ImagingJpegDecode fails to verify libjpeg's actual output dimensions after requesting downscaling, causing a heap buffer overflow when libjpeg-turbo 3.x ignores scale requests on 8-bit lossless SOF3 JPEGs.
Affected systems
Pillow versions prior to 13.0.0 linked against libjpeg-turbo 3.x
CVSS v4.0 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade Pillow to version 13.0.0 or later. If patching immediately is not possible, stop using draft() or thumbnail() for untrusted JPEGs, or run against libjpeg-turbo 2.x/IJG which rejects SOF3 inputs.
$ pip install --upgrade "pillow>=13.0.0"AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can ignore the requested downscaling geometry. An attacker can supply such a JPEG to an application that uses draft() or thumbnail() to request downscaling. This can corrupt heap memory, crash the process, or potentially allow code execution. Older libjpeg-turbo 2.x and IJG builds reject the SOF3 input. This issue is fixed in version 13.0.0.