PatchTheCEVCVE-2026-112398: Pillow is a Python imaging library
CVE-2026-112398 is a critical-severity flaw (CVSS 9.2) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four components, causing ImagingJpegDecode to write four-component scanlines into the two-byte tile buffer. An attacker can supply a crafted OLE2 FlashPix fi
Why this priority
- Critical severity
- CISA SSVC: public proof of concept
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.