Pillow JPEG Flaw Lets Attackers Write Past Memory Bounds in v12.3.0

Attackers can achieve arbitrary memory writes by supplying a standards-compliant lossless JPEG file to applications using Pillow version 12.3.0 or earlier. This capability stems from a mismatch between the size of the memory buffer allocated for image decoding and the actual data volume returned by the underlying library. According to the GitHub advisory GHSA-8g5g-8vmr-9782, the issue is rated critical and affects the widely used Python imaging library.

In plain English

When Pillow processes a JPEG image, it often creates a smaller preview or thumbnail to save resources. It calculates a reduced size and allocates a memory buffer that matches this smaller dimension. However, for specific types of lossless JPEG files, the underlying decoding library ignores the request to scale down the image. Instead, it returns the full-resolution data. This larger dataset is written into the smaller buffer, causing data to spill over into adjacent memory areas.

The background

The vulnerability exists in the `JpegImageFile.draft()` function, which is called automatically when generating thumbnails. This function requests scaled output and shrinks the expected image size, leading the system to allocate a single-row decode buffer sized for the reduced dimensions. The `ImagingJpegDecode()` function then sets scaling parameters and starts decompression. Crucially, it fails to compare the actual output dimensions returned by the library against the expected state variables before reading scanlines into the buffer.

What changes now

Pillow version 13.0.0 has been released to address CVE-2026-112403. This update fixes the logic error that allowed the buffer overflow. Users of Pillow should upgrade to version 13.0.0 or later to mitigate the risk. The advisory notes that the input file is a standards-compliant JPEG, meaning standard format checks do not prevent the exploit. The overflow bytes correspond to decoded pixel values, which can be predictable for 8-bit grayscale images.

What made it possible

This incident illustrates the danger of trusting external libraries to adhere to application-level constraints without explicit verification. Teams usually assume that passing a scaling parameter ensures the output fits within pre-allocated buffers. However, when libraries handle edge cases like lossless compression differently, silent deviations can occur.

Check whether your image processing code validates output dimensions against buffer sizes before writing data. Ensure that geometry checks are performed after decompression starts but before scanlines are read. Relying on format signatures alone is insufficient if the underlying decoder behaves unexpectedly for valid but unusual file structures.

What to do and how to stay safe: Pillow

• Update Pillow to version 13.0.0 or later to apply the vendor-provided fix for CVE-2026-112403.
• Monitor applications that process untrusted JPEG images, particularly those generating thumbnails or previews.
• Implement input validation that checks image dimensions and file types before passing them to the imaging library.
• Watch for anomalous behavior or crashes in services that handle lossless JPEG files, which may indicate exploitation attempts.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Pillow are affected by this vulnerability?

Pillow versions 12.3.0 and earlier are vulnerable to the heap overflow described in CVE-2026-112403.

Is there a fix available for this issue?

Yes, Pillow version 13.0.0 has been released to patch the critical heap overflow in JPEG processing.

What type of file triggers this vulnerability?

A standards-compliant lossless JPEG file (SOF3) triggers the overflow when processed by vulnerable versions of Pillow.