Critical Flaw in Python Pillow Library Allows RCE

Pillow, a ubiquitous Python image processing library, has been found to contain several high-severity vulnerabilities, most notably CVE-2026-112900. This flaw allows for remote code execution (RCE) by exploiting the way the library handles Encapsulated PostScript (EPS) files via Ghostscript. By providing a specially crafted filename, an attacker can trick Ghostscript into executing arbitrary commands. Additional critical vulnerabilities include heap overflows in JPEG decoding (CVE-2026-112403) and TIFF image saving (CVE-2026-112393).

Technical details indicate that the EPS flaw is triggered by user-controlled filenames rather than the image content itself, while the JPEG and TIFF flaws rely on memory buffer overflows during processing. The impact is significant given Pillow's widespread use in web upload forms, machine learning pipelines, and document processing tools. Although no active exploitation has been reported, the library's monthly download rate of over 400 million underscores the broad potential attack surface.