Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

影響: pip:pillow <= 12.3.0 → 13.0.0

Credits Researcher: Alex Bouffard (mixbo@pebwalker.com) Summary A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with Image.open(). The file is recognized by content (the OLE2 magic), not by extension, so any service that opens or thumbnails untrusted uploads with the optional olefile dependency installed is reachable with no user interaction. In the PoC below, opening on…

GitHub Advisory Databaseで読む

2026/10/24 06:55、GitHub Advisory Databaseが「Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「緊急」(critical) です。関連する技術: Python。CVE: CVE-2026-112398。