Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

影響: pip:pillow <= 12.3.0 → 13.0.0

Credits Researcher: Alex Bouffard (mixbo@pebwalker.com) Summary A heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with Image.open(). The file is recognized by content (the OLE2 magic), not by extension, so any service that opens or thumbnails untrusted uploads with the optional olefile dependency installed is reachable with no user interaction. In the PoC below, opening on…

在 GitHub Advisory Database 阅读

2026/10/24 06:55，GitHub Advisory Database 发布了“Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution”（类型：漏洞公告）。严重程度为“严重”（critical）。相关技术：Python。CVE：CVE-2026-112398。