Python’s popular image-handling library Pillow contains a serious security flaw—CVE-2026-112900—that allows remote code execution if it processes an EPS (Encapsulated PostScript) image with a filename crafted by an attacker. This opens the door for exploits when untrusted filenames are passed to Pillow’s Image.open(), which hands off EPS rendering to Ghostscript without verifying the filename.
What’s at risk
Ghostscript, the external program Pillow uses to convert EPS files to pixel data, can be manipulated via the EPS filename itself. An attacker could point the rendering process toward a secondary file that executes operating system commands rather than simply reading data. While the content of the EPS file doesn’t matter, the filename becomes the attack vector. Servers with Ghostscript installed are vulnerable; the issue affects Pillow versions from 2.6.0 through 12.3.0.
Additional high-severity flaws
The patch bundle delivered in Pillow 13.0.0, released October 16, fixes not only the EPS-filename exploit but also other critical and moderate bugs in JPEG, TIFF, and FlashPix support. One JPEG processing bug allows code execution when opening a specially crafted FPX image with the optional olefile package installed. A TIFF issue that has existed since 2013 can lead to code execution only when paired with a separate memory leak vulnerability. There’s also a thumbnailing bug in lossless JPEGs and a memory overflow when saving compressed TIFF to in-memory buffers.
According to the advisory, some of these flaws score 9.2 out of 10, the highest critical severity. However, many require specific conditions like control over filenames or enabling optional dependencies. As of now, there’s no evidence of widespread exploitation of the EPS filename flaw; others have proof-of-concepts or are in early stages of disclosure.
What you should do now
The fix is upgrading to Pillow 13.0.0, which drops support for Python 3.10—so environments using 3.10 need to update to Python 3.11 or newer as well. Then rebuild any Docker images, virtual environments, wheels, or other packaged artifacts that include older Pillow versions.
For systems that can’t upgrade right away, the advisory outlines mitigation strategies: remove Ghostscript from hosts handling untrusted uploads, avoid using Image.open() on EPS files with attacker-controlled filenames, skip using thumbnail() or draft() on untrusted JPEGs, call load() on JPEGs first or set reducing_gap=None, and treat saving TIFFs to in-memory buffers like io.BytesIO as risky if the source is untrusted.
The scope of the problem is broad: Pillow underpins many Python-based tools—everything from web upload forms and avatar generation to document pipelines and machine learning preprocessing. That matters because the library sees hundreds of millions of downloads per month, and many systems process image uploads without strong filename sanitization.
This release contains critical updates across four severity levels, with two flaws rated ‘critical’ by maintainers, one involving JPEG FPX decoding, another risky buffer overflow in TIFF files. Even lower-rated issues can pose risks in chained attacks or misconfigured environments. Users should promptly check their Pillow-dependent components and environments.
Analytical view: this multi-bug release highlights modern open source risk: deep dependencies, subtle attack vectors like filenames, optional modules that dramatically widen the threat surface. For admins, it’s a wake-up call to adopt more rigorous validation of everything users can control—including filenames. What to watch: whether attackers begin exploiting the EPS filename flaw in real-world uploads, and how quickly major frameworks update their Pillow usage defaults. The long tail of Python-3.10 users is also a concern in terms of adoption lag.
