OESA-2026-4663: python-pillow security update
Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816) Security Fix(es):
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCSUNKNOWN with four components, causing ImagingJpegDecode to write four-component scanlines into the two-byte tile buffer. An attacker can supply a crafted OLE2 FlashPix file to an application with the optional olefile dependency installed that opens or thumbnails untrusted input. This can corrupt heap memory and may allow arbitrary code execution. This issue is fixed in version 13.0.0.(CVE-2026-112398)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/python-pillowto a version that resolves this vulnerability.Fixed in 9.0.1-17.oe2203sp4 - Upgrade
Upgrade
python-pillowto a version that resolves this vulnerability.Fixed in 13.0.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using Pillow prior to 13.0.0 are exposed if they have the optional olefile dependency installed and open or generate thumbnails for untrusted OLE2 FlashPix files. The issue is in FlashPix JPEG-tile decoding.
What does an attacker need to exploit the vulnerability?
An attacker needs to supply a crafted OLE2 FlashPix file to a vulnerable application. No authentication or user interaction is indicated by the provided severity vector.
Are default Pillow installations affected?
The vulnerable path requires the optional olefile dependency and processing of FlashPix input. Deployments without olefile installed, or that do not open or thumbnail untrusted OLE2 FlashPix files, are not described as affected.
What is the remediation?
Update Pillow to version 13.0.0, which fixes the out-of-bounds scanline write in the FlashPix JPEG-tile decoder.
What is the impact if exploitation succeeds?
A crafted file can corrupt heap memory because four-component JPEG scanlines may be written into a two-byte tile buffer. The advisory states that this may allow arbitrary code execution.