## Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

- 種別: advisory
- 重大度: critical
- 関連技術: python
- CVE: CVE-2026-112398
- 公開日時: 2026-10-23T21:55:21.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-5x8w-8jj5-q52h)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-5x8w-8jj5-q52h

影響: pip:pillow <= 12.3.0 → 13.0.0
Credits Researcher: Alex Bouffard (mixbo@pebwalker.com) Summary A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with Image.open(). The file is recognized by content (the OLE2 magic), not by extension, so any service that opens or thumbnails untrusted uploads with the optional olefile dependency installed is reachable with no user interaction. In the PoC below, opening on…