CVE-2026-112398

Credits

Researcher: Alex Bouffard ([email protected])

Summary

A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with Image.open(). The file is recognized by content (the OLE2 magic), not by extension, so any service that opens or thumbnails untrusted uploads with the optional olefile dependency installed is reachable with no user interaction. In the PoC below, opening one crafted file executes an attacker-chosen command on stock Pillow 12.2.0 (x86_64 Ubuntu 24.04, glibc 2.39).

Details

FpxImagePlugin decodes FlashPix (FPX) files, which are OLE2/CFBF compound documents.

Image.open() auto-detects them from the OLE2 magic D0CF11E0... whenever the optional olefile package is installed (Pillow's documented dependency for FPX/MIC support), regardless of the file's extension.

For a JPEG-compressed subimage (compression == 2), the plugin builds a "jpeg" decode tile and derives the (rawmode, jpegmode) pair from attacker-controlled FPX color IDs through the MODES table (src/PIL/FpxImagePlugin.py L25-L32):

MODES = {
    ...
    (0x00018000, 0x00017FFE): ("RGBA", "LA"),                # rawmode "LA"  (2 bytes/pixel)
    ...
    (0x00020000, 0x00020001, 0x00020002): ("RGB", "YCC;P"),  # rawmode "YCC;P"
}

The Imaging output buffer for the tile is sized for the rawmode (here "LA" = 2 bytes/pixel) (src/decode.c L223-L226):

state->bytes = (state->bits * state->xsize + 7) / 8;   // "LA" gives 2 * xsize bytes/row
...
state->buffer = (UINT8 *)calloc(1, state->bytes);

In JpegDecode.c the rawmode string is mapped to a libjpeg out_color_space. Recognized modes (CMYK, YCbCr, YCbCrK, and so on) get a concrete colorspace, but "LA" and "YCC;P" are not recognized, so control reaches the fallback branch (src/libImaging/JpegDecode.c L219-L221):

/* Disable decoder conversions. */
context->cinfo.jpeg_color_space = JCS_UNKNOWN;
context->cinfo.out_color_space  = JCS_UNKNOWN;

Under JCS_UNKNOWN, libjpeg performs no color conversion and emits cinfo.num_components bytes per pixel, taken from the embedded JPEG's SOF marker, which the attacker sets to 4. So jpeg_read_scanlines writes 4 * width bytes per row into a buffer allocated for only 2 * width bytes (src/libImaging/JpegDecode.c L252):

ok = jpeg_read_scanlines(&context->cinfo, &state->buffer, 1);   // writes 4*W into a 2*W buffer

This is a heap out-of-bounds write with attacker-controlled length (the image width, up to tens of thousands of pixels, so about 2 * width bytes of overflow per row) and attacker-controlled content (the decoded pixel data). The PoC weaponizes it: the overflow overwrites an adjacent Python bytes object's ob_type with a pointer to a fake PyTypeObject / PyBufferProcs vtable that the same overflow plants inside the decode buffer. When Pillow releases the input buffer, PyBuffer_Release walks ob_type -> tp_as_buffer -> bf_releasebuffer and executes call *rax; the PoC points that at system@plt (fixed, the interpreter binary is non-PIE) with rdi set to the command string, yielding command execution.

PoC

To facilitate an exact reproduction on an x86_64 machine, this PoC uses the version-pinned, ASLR-disabled Docker image from Annex A.

The source code for the payload builder make_payload.py is in Annex B.

vulnerable.py is the program under test, a one-liner that opens the file it is given:

#!/usr/bin/env…

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)

Security Fix(es):

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four components, causing ImagingJpegDecode to write four-component scanlines into the two-byte tile buffer. An attacker can supply a crafted OLE2 FlashPix file to an application with the optional olefile dependency installed that opens or thumbnails untrusted input. This can corrupt heap memory and may allow arbitrary code execution. This issue is fixed in version 13.0.0.(CVE-2026-112398)

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four components, causing ImagingJpegDecode to write four-component scanlines into the two-byte tile buffer. An attacker can supply a crafted OLE2 FlashPix file to an application with the optional olefile dependency installed that opens or thumbnails untrusted input. This can corrupt heap memory and may allow arbitrary code execution. This issue is fixed in version 13.0.0.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (CVE-2026-112393)

• pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution (CVE-2026-112398)

• pillow: Pillow: Argument Injection in Ghostscript call, potentially leading into RCE (CVE-2026-112900)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four components, causing ImagingJpegDecode to write four-component scanlines into the two-byte tile buffer. An attacker can supply a crafted OLE2 FlashPix file to an application with the optional olefile dependency installed that opens or thumbnails untrusted input. This can corrupt heap memory and may allow arbitrary code execution. This issue is fixed in version 13.0.0.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (CVE-2026-112393)
• pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution (CVE-2026-112398)
• pillow: Pillow: Argument Injection in Ghostscript call, potentially leading into RCE (CVE-2026-112900)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four components, causing ImagingJpegDecode to write four-component scanlines into the two-byte tile buffer. An attacker can supply a crafted OLE2 FlashPix file to an application with the optional olefile dependency installed that opens or thumbnails untrusted input. This can corrupt heap memory and may allow arbitrary code execution. This issue is fixed in version 13.0.0.

TuxCare rebuilt pillow to address 11 CVEs. Fixed in 11.3.0.post7+tuxcare.

TuxCare rebuilt pillow to address 11 CVEs. Fixed in 11.2.1.post9+tuxcare.

TuxCare rebuilt pillow to address 11 CVEs. Fixed in 10.4.0.post11+tuxcare.

TuxCare rebuilt pillow to address 11 CVEs. Fixed in 9.5.0.post9+tuxcare.

TuxCare rebuilt pillow to address 10 CVEs. Fixed in 9.4.0.post10+tuxcare.

TuxCare rebuilt pillow to address 9 CVEs. Fixed in 8.4.0.post9+tuxcare.

These are all security issues fixed in the python313-Pillow-13.0.0-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2026-112398 in the pillow package for Root:PyPI. Multiple fixed versions available.

This update for python-Pillow fixes the following issues:

• CVE-2026-96636: decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (bsc#1286802).
• CVE-2026-96637: decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS (bsc#1286801).
• CVE-2026-96640: PDF append accepts malformed shared page-tree DAG, which can cause resource exhaustion (bsc#1286798).
• CVE-2026-96641: reachable undefined behavior in native integer operations can lead to denial of service or logic integrity compromise (bsc#1286797).
• CVE-2026-96642: TarIO negative size field causes infinite CPU-spin loop (bsc#1286796).
• CVE-2026-112390: Denial of Service via infinite loop during crafted MIC image parsing (bsc#1286256).
• CVE-2026-112391: Denial of Service via unbounded recursion in PDF parser (bsc#1286273).
• CVE-2026-112392: Denial of Service via zero-size images in rank filters (bsc#1286287).
• CVE-2026-112393: heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data (bsc#1286325).
• CVE-2026-112394: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size (bsc#1286311).
• CVE-2026-112397: out-of-bounds access in _imagingmorph on a zero-width image (bsc#1286314).
• CVE-2026-112398: heap buffer overflow in FPX JPEG decoding can lead to code execution (bsc#1286406).
• CVE-2026-112399: Denial of service via crafted APNG image (bsc#1286368).
• CVE-2026-112400: Denial of Service via memory exhaustion from crafted GIF image (bsc#1286370).
• CVE-2026-112401: Denial of Service via crafted GIF comments (bsc#1286372).
• CVE-2026-112402: Denial of service via double free during image transformation (bsc#1286381).
• CVE-2026-112403: heap buffer overflow in ImagingJpegDecode allows for code execution (bsc#1286405).
• CVE-2026-112405: NULL pointer dereference in Image.merge via an unvalidated band 0 (bsc#1286404).
• CVE-2026-112406: infinite loop in PdfParser.rewrite_pages on page tree Parent cycle (bsc#1286403).
• CVE-2026-112891: quadratic GIF comment copying during save (bsc#1286402).
• CVE-2026-112892: MSP RLE decoder expands a tiny file into unbounded memory (bsc#1286401).
• CVE-2026-112894: Denial of Service via crafted multi-frame image conversion (bsc#1286408).
• CVE-2026-112895: Denial of service via crafted PDF during append operations (bsc#1286411).
• CVE-2026-112896: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read (bsc#1286400).
• CVE-2026-112897: TiffDecode returns uninitialized memory as pixels for short JPEG strips (bsc#1286398).
• CVE-2026-112899: EPS load(scale) lets Ghostscript render past the decompression bomb limit (bsc#1286489).
• CVE-2026-112900: argument Injection in Ghostscript call can lead to remote code execution (bsc#1286397).
• CVE-2026-112901: ReDoS in XbmImagePlugin can be triggered by 512-byte file (bsc#1286396).
• CVE-2026-112902: memory disclosure and segfault in libtiff encoder via crafted TIFF tags (bsc#1286804).