「CVE-2026-112398」の検索結果
10月24日(土)昨日
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
影響: pip:pillow <= 12.3.0 → 13.0.0 Credits Researcher: Alex Bouffard (mixbo@pebwalker.com) Summary A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with Image.open(). The file is recognized by content (the OLE2 magic), not by extension, so any service that opens or thumbnails untrusted uploads with the optional olefile dependency installed is reachable with no user interaction. In the PoC below, opening on…