Pillow Security Vulnerabilities: Upgrade to 13.0.0

Pillow 13.0.0 fixes a large batch of security flaws disclosed in October 2026, including code execution bugs. How to check your version and upgrade.

Upgrade to Pillow 13.0.0 or later. Pillow, the standard Python imaging library, shipped a large security release on 16 October 2026, and GitHub published about 40 separate Pillow advisories between 20 and 23 October. Several can lead to memory corruption or code execution when an application opens a crafted file. This page explains what was disclosed, who is exposed, and what to do. It was last checked on 24 October 2026.

What to do now

1. Check your version in every environment you run:

   python -c "import PIL; print(PIL.__version__)"

2. Upgrade to 13.0.0 or later:

   python -m pip install -U "Pillow>=13.0.0"

   Pillow 13 requires Python 3.11 or newer: it dropped Python 3.10, which reached end of life in October 2026. See Python version end-of-life dates if you are still on 3.10.

3. Rebuild anything that bundles an old copy: container images, wheels, lockfiles and deployed servers. Many packages pull Pillow in as a dependency, so run pip show pillow to see what requires it.

4. Then tighten how you handle untrusted images, using the steps below.

What was disclosed

The fixes are listed in the Pillow 13.0.0 release notes, grouped by the maintainers’ own severity ratings (critical, high, medium and low). The two critical entries are:

• Stale native image storage reused after mode transitions (CVE-2026-96639): multi-frame image loaders could write wider pixel data into a smaller buffer left over from an earlier frame.
• A JPEG decoder buffer overflow from scanlines wider than the tile extents (GHSA-5x8w-8jj5-q52h and GHSA-8g5g-8vmr-9782). One of these, in the FlashPix (FPX) decoder, was reported to run an attacker’s command from a single Image.open() call on a crafted file. The advisory says this applies when the optional olefile package is installed, and that Pillow recognises these files by their content rather than their extension.

Other fixes include TIFF encoder and decoder memory errors, PDF parsing recursion and resource exhaustion, several “decompression bomb” check bypasses, and a bundled OpenJPEG heap overflow. One that has had wide coverage is CVE-2026-112900, argument injection when Pillow calls Ghostscript to open an EPS file: the advisory says a filename beginning with - is read by Ghostscript as an option. It only matters on hosts with the gs program installed.

The severity labels differ between sources. GitHub’s advisory database labels five of them critical, while the release notes list two critical entries and rate the Ghostscript issue medium and the in-memory TIFF overflow high. Treat the labels as a guide and read each advisory against how your own application uses Pillow.

Who is exposed

The common thread is that an attacker supplies the file. The most exposed are:

• upload forms and avatar or thumbnail services,
• document and PDF pipelines,
• machine-learning data loaders that read untrusted images,
• anything that opens, converts or saves images from users in formats you didn’t choose.

A script that only processes your own trusted images is far less exposed. The Hacker News reported on 23 October that none of the flaws was known to be under attack at that point.

Reduce your exposure beyond upgrading

Pillow’s own security guidance lists mitigations in priority order. The ones that matter most for most applications:

• Sandbox image processing. Run Pillow in a restricted subprocess or container, isolated from your main application.
• Block or sandbox EPS. Reject EPS files at the application boundary, or run Ghostscript in an isolated container.
• Allow only the formats you need. Pass a list to Image.open(..., formats=...) so a crafted file in an unexpected format is never decoded.
• Keep MAX_IMAGE_PIXELS set (never None) and treat Image.DecompressionBombWarning as an error.
• Never use ImageMath.unsafe_eval() with user input.
• Strip metadata from user uploads before serving them.
• Pin dependencies with hashes (pip install --require-hashes) and keep Pillow’s bundled C libraries current by upgrading Pillow itself.
• Log failures from Image.open() and decompression-bomb checks, so attacks show up.

For the specific bugs, The Hacker News reported these interim steps from the advisories: keep Ghostscript off hosts that process untrusted uploads, avoid draft() and thumbnail() on untrusted JPEGs, and treat saving a TIFF to an in-memory buffer such as io.BytesIO as a sensitive path. Upgrading is the real fix.

Sources

• Pillow 13.0.0 release notes and security handbook page
• GitHub Advisory Database entries for Pillow
• The Hacker News report, 23 October 2026

See the Pillow resource page for the library itself, and Python dependency security for how to audit, pin and update packages so the next advisory is quick to deal with.