Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

影響: pip:pillow <= 12.3.0 → 13.0.0

Credits Researcher: Alex Bouffard (mixbo@pebwalker.com) Summary A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with Image.open(). The file is recognized by content (the OLE2 magic), not by extension, so any service that opens or thumbnails untrusted uploads with the optional olefile dependency installed is reachable with no user interaction. In the PoC below, opening on…

Read on GitHub Advisory Database

On 10/24/2026, 06:55 AM, GitHub Advisory Database published "Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution" (type: Advisory). Severity is "Critical" (critical). Related technologies: Python. CVE: CVE-2026-112398.