Pillow 13.0.0 fixes 38 security issues, from a Ghostscript argument injection to JPEG overflows

Pillow 13.0.0, released on 16 October, is mostly a security release. Its notes list 38 security entries covering 40 CVE identifiers: two rated critical by the maintainers, 13 high, 20 medium and three low. Pillow is the image library under a large share of Python, from upload handlers and thumbnailers to PDF tools and machine learning data loaders, so this one is worth a dependency check.

The flaws worth knowing

• EPS argument injection, CVE-2026-112900. When Pillow renders an EPS file it calls Ghostscript and puts the file path straight into the command line. The advisory says a filename starting with a dash is read by Ghostscript as an option, which can be chained to code execution. It affects Pillow 2.6.0 up to, but not including, 13.0.0, needs the gs program installed, and needs an attacker to influence the filename. The maintainers rate it medium; the GitHub-assigned CVE record scores it 9.2.
• JPEG decoder overflows, CVE-2026-112398 and CVE-2026-112403. These sit in the maintainers’ critical tier, described as a buffer overflow from scanlines wider than tile extents. The advisory for CVE-2026-112403 covers a heap overflow reached by making a thumbnail of a crafted lossless JPEG, and reports a crash. It says the bug was “found by Anthropic using Claude to study the security of open-source software, validated manually by Ada Logics”. The Hacker News reports that the other JPEG flaw, in the FlashPix format, ran an attacker’s command from a single Image.open() call when the optional olefile package is installed. We could not open that advisory, so treat the code execution detail as reported.
• Stale image storage, CVE-2026-96639. The other critical entry: native image storage reused after mode transitions.
• TIFF save overflow, CVE-2026-112393. A heap overflow when saving a compressed TIFF to a file object such as BytesIO, present since Pillow 2.0.0 in 2013. The advisory says saving to a file on disk is not affected. That in-memory pattern is common in services that re-encode an upload and send it back.

The Hacker News reports that CISA’s analysts mark no known exploitation for the EPS flaw and a public proof of concept for the TIFF one, and cites OX Security’s estimate of about 436 million Pillow downloads a month.

What to do

1. Upgrade: pip install -U "Pillow>=13.0.0", then pin it in your lockfile. PyPI shows 13.0.0 as current.
2. Rebuild container images and redeploy. Pillow is often a transitive dependency, so check with pip show pillow or your SBOM rather than your direct requirements.
3. Check your Python version. 13.0.0 requires Python 3.11 or newer; Python 3.10 support is gone. Services stuck on 3.10 need a Python upgrade before they can take these fixes.
4. Until you can upgrade, avoid opening untrusted EPS files on hosts with Ghostscript, and never pass user-controlled names as file paths.

The release has a few other behavior changes, such as no longer clipping 32-bit I mode images when saving PNG, so read the backwards incompatible section of the notes before you ship.