Pillow JPEG Buffer Overflow: Arbitrary Memory Writes in v12.3.0 and Earlier via Standard Lossless Files
A critical buffer overflow in Pillow's JPEG decoder affects versions up to 12.3.0, allowing arbitrary memory writes via standard lossless image files.
Key points
- The flaw exists in Pillow versions 12.3.0 and earlier, with a fix in version 13.0.0.
- Attackers can exploit the issue using standards-compliant lossless JPEG images.
- The vulnerability enables arbitrary memory writes due to a mismatch in buffer sizing.
The Pillow library for Python contains a critical heap buffer overflow in its JPEG processing code. This flaw affects applications using Pillow version 12.3.0 or earlier. As BlueTeam Insider reported on 2026-10-20 regarding TIFF handling, Pillow has faced similar memory safety issues. This new vulnerability involves lossless JPEG parsing.
Root cause
The defect arises in the `JpegImageFile.draft()` method, which is called automatically by `Image.thumbnail()`. This function requests scaled output and shrinks the internal size and tile extents. Consequently, `_setimage()` allocates a single-row decode buffer sized for the scaled dimensions. However, `ImagingJpegDecode()` fails to compare the actual output width and height against the allocated buffer state.
Attack path
When libjpeg-turbo 3.x processes a lossless JPEG stream, it hardwires the decoding to ignore scaling requests. The library returns full-width rows into the undersized buffer. Each scanline read writes bytes past the end of the heap allocation. The overflowing data consists of decoded pixel values, which are byte-exact for 8-bit grayscale lossless images.
Affected versions
- Pillow versions up to and including 12.3.0 are vulnerable.
- Pillow version 13.0.0 patches the issue.
- The vulnerability is tracked as CVE-2026-112403.
Mitigation
- Upgrade Pillow to version 13.0.0 immediately.
- Restrict input to trusted sources if upgrading is not possible.
- Avoid processing untrusted lossless JPEG images.
- Monitor for unexpected process crashes or memory corruption signs.
Detection notes
Security teams should monitor application logs for unexpected segmentation faults or access violations when processing image files. Check for anomalous memory usage spikes during thumbnail generation. Inspect network traffic for unusual JPEG payloads if external services accept uploads. Verify that image processing pipelines enforce strict format validation. Look for signs of heap corruption in core dumps. Ensure that logging captures the full file path and metadata of processed images for forensic analysis.
What to do and how to stay safe: Pillow
- Update Pillow to version 13.0.0 once the vendor provides an update.
- Restrict image upload capabilities to trusted users only.
- Implement file type validation at the application layer.
- Monitor server logs for crashes related to image processing.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does restricting file extensions prevent this attack?
No, because the input is a standards-compliant JPEG file, and Pillow accepts the SOF3 marker for lossless images.
Which specific function triggers the overflow?
The `JpegImageFile.draft()` method, often called by `Image.thumbnail()`, triggers the buffer size mismatch.
Is there a workaround before patching?
Avoid processing lossless JPEG images or restrict input to trusted sources until version 13.0.0 is deployed.
