Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
Summary
A critical vulnerability has been discovered in Python's popular Pillow image library, identified as CVE-2026-112900. The flaw allows for arbitrary code execution on a server when Pillow processes a specially crafted EPS image file. This is due to Pillow's insecure handling of EPS image filenames, which are passed directly to the Ghostscript interpreter without proper validation.
IFF Assessment
This vulnerability allows attackers to execute arbitrary code on a server, posing a significant risk to systems and data.
Severity
The CVSS score is estimated high due to the potential for remote code execution (attack vector: network) with significant impact on confidentiality, integrity, and availability, and exploitability through a crafted image file.
Defender Context
Defenders should prioritize patching or updating the Pillow library to mitigate this critical vulnerability. This incident highlights the importance of input validation and secure handling of external dependencies, especially when processing untrusted file formats. Developers should be aware of the risks associated with integrating libraries that interact with other interpreters or command-line tools.