Skip to content
OpenAdvisories
Critical ALSA-2026:93077 3 CVEs

Critical: python-pillow security update

Published Oct 30, 2026 · Updated Oct 31, 2026

Ecosystem: AlmaLinux

Summary

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (CVE-2026-112393)
* pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution (CVE-2026-112398)
* pillow: Pillow: Argument Injection in Ghostscript call, potentially leading into RCE (CVE-2026-112900)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 4

ReleasePackageFixed in
AlmaLinux · 8 python3-pillow 5.1.1-36.el8_10
AlmaLinux · 8 python3-pillow-devel 5.1.1-36.el8_10
AlmaLinux · 8 python3-pillow-doc 5.1.1-36.el8_10
AlmaLinux · 8 python3-pillow-tk 5.1.1-36.el8_10

Vulnerabilities 3

  • Critical 9.2
    CVE-2026-112393

    Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

    Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback si…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • Critical 9.2
    CVE-2026-112398 Public exploit

    Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

    Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode c…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • Critical 9.2
    CVE-2026-112900 Public exploit

    Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

    Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe abso…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-112393
  • report
    https://access.redhat.com/security/cve/CVE-2026-112398
  • report
    https://access.redhat.com/security/cve/CVE-2026-112900
  • report
    https://bugzilla.redhat.com/2555846
  • report
    https://bugzilla.redhat.com/2555867
  • report
    https://bugzilla.redhat.com/2555889
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-93077.html