CVE-2026-112403
Reported by GitHub_M · Published October 19, 2026
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can ignore the requested downscaling geometry. An attacker can supply such a JPEG to an application that uses draft() or thumbnail() to request downscaling. This can corrupt heap memory, crash the process, or potentially allow code execution. Older libjpeg-turbo 2.x and IJG builds reject the SOF3 input. This issue is fixed in version 13.0.0.
Risk Scores
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| python-pillow | Pillow | < 13.0.0 |
| chainguard | kserve | 0 |
| wolfi | py3-pillow | 0 |
| chainguard | netbox-fips | 0 |
| wolfi | open-webui | 0 |
| wolfi | superset-6.0 | 0 |
| chainguard | kubeflow-pipelines-visualization-server | 0 |
| chainguard | superset-5.0 | 0 |
| chainguard | superset-6.1 | 0 |
| chainguard | apache-beam-python-3.13-sdk | 0 |
| wolfi | kubeflow-pipelines-visualization-server | 0 |
| chainguard | label-studio | 0 |
| chainguard | py3-pillow | 0 |
| chainguard | netbox | 0 |
| chainguard | openstack-horizon-2026.1 | 0 |
| chainguard | openstack-horizon-2025.2-fips | 0 |
| chainguard | kserve-xgbserver | 0 |
| chainguard | pgadmin4-fips | 0 |
| chainguard | tensorflow-cpu-jupyter | 0 |
| wolfi | superset-6.1 | 0 |
…and 19 more
Timeline
- Oct 19, 2026 CVE Published
- Oct 20, 2026 EPSS Score
- Oct 20, 2026 Coalition ESS Score
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 27, 2026 CVE Updated
- Oct 29, 2026 EPSS Score
- Oct 30, 2026 Security Advisory
- Nov 3, 2026 EPSS Score
References
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-8g5g-8vmr-9782 x_refsource_CONFIRM
- https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75 x_refsource_MISC
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-112403 advisory
- https://github.com/advisories/GHSA-8g5g-8vmr-9782 advisory