Multiple security vulnerabilities have been identified in Pillow, an image-processing library, affecting EPS rendering, font glyph rendering, image merging, GIF saving, and TIFF encoding. The flaws can allow remote attackers to cause denial of service, memory disclosure, or remote code execution when processing crafted image files. Affected version ranges vary by vulnerability, including versions 2.6.0 through 12.3.0, 9.2.0 through 12.3.0, 10.0.0 through 12.3.0, and 12.0.0 through 12.3.0.
CVE-2026-112900 (CVSS 9.2 — Critical): Argument injection occurs when Pillow constructs a Ghostscript command for EPS image rendering using an attacker-influenced filename. A remote attacker who can control the filename can inject command-line arguments, potentially achieving remote code execution.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Pillow, an image-processing library, affecting EPS rendering, font glyph rendering, image merging, GIF saving, and TIFF encoding. The flaws can allow remote attackers to cause denial of service, memory disclosure, or remote code execution when processing crafted image files. Affected version ranges vary by vulnerability, including versions 2.6.0 through 12.3.0, 9.2.0 through 12.3.0, 10.0.0 through 12.3.0, and 12.0.0 through 12.3.0.
CVE-2026-112900 (CVSS 9.2 — Critical): Argument injection occurs when Pillow constructs a Ghostscript command for EPS image rendering using an attacker-influenced filename. A remote attacker who can control the filename can inject command-line arguments, potentially achieving remote code execution.[emaillocker id="1283"]
CVE-2026-112893 (CVSS 8.2 — High): An invalid free occurs in FreeType glyph rendering when text is drawn with a non-zero stroke width and glyph loading fails. A remote attacker can supply a malformed font to trigger the unsafe cleanup and crash the process.
CVE-2026-112405 (CVSS 8.7 — High): A null pointer dereference occurs in the image merge operation when the first input band is not validated. A remote attacker can craft an IPTC image so that opening and loading it causes a hard crash.
CVE-2026-112891 (CVSS 6.9 — Medium): Excessive CPU consumption occurs when saving a GIF with a long comment because portions of the comment are copied repeatedly. A remote attacker can provide such a GIF to cause denial of service in services that resave uploaded images.
CVE-2026-112902 (CVSS 8.8 — High): A memory disclosure and segmentation fault occur in the TIFF encoder when crafted TIFF tags are processed. A remote attacker can supply a malicious TIFF file to expose memory contents and crash the process.
These vulnerabilities collectively present a significant risk to applications that process untrusted image files, especially network-facing services that render, merge, save, or encode uploaded content. The most at risk are systems that accept EPS, font, IPTC, GIF, or TIFF input without strict validation. They should be treated as high-priority security issues.
We recommend you to update Pillow to version 13.0.0.
The following reports contain further technical details:
[/emaillocker]