CVE-2026-54058

Pillow wheels from 11.1.0 onward bundle a libopenjp2 containing a heap-buffer-overflow write that is fixed upstream on master but has never appeared in an OpenJPEG release. Because the wheel bundles its own copy, a patched host library does not protect against the issue.

Pillow versions 11.0.0 through 13.0.0 mishandle multi-frame images (PSD, MPO, DCX, MIC). When a later frame switches to a wider mode (RGB/CMYK), the stale narrow-mode buffer is reused, causing out-of-bounds writes and crashes, and in some runtime profiles command execution.

Pillow, a Python imaging library, from 2.6.0 until 13.0.0 is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a hyphen can be interpreted as a Ghostscript option.

Pillow prior to 13.0.0 has a JPEG decoder vulnerability where a full-width scanline can be written into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width after scaling, and an 8-bit lossless SOF3 JPEG decoded by libjpeg-turbo 3.x can ignore the requested downscaling geometry.

Pillow prior to 13.0.0 has a FlashPix JPEG-tile decoder vulnerability that can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four components, causing ImagingJpegDecode to write four-component scanlines into the two-byte tile buffer.

Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback sizes its allocation from the prior buffer size instead of the current write position, allowing data to be copied beyond the allocation. This is fixed in version 13.0.0.

Integer overflow in the ImagingResampleHorizontal function in Pillow before version 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, leading to a heap-based buffer overflow.

In Pillow through 12.3.0, the libtiff TIFF encoder can pass arguments to TIFFSetField() that do not match libtiff's definition of the corresponding tag. When an application saves attacker-controlled image metadata through this encoder, crafted tag values can cause invalid memory reads, copying process memory into the encoded output or crashing the process.

Pillow versions 2.3.0 through 12.3.0 do not validate scaled image dimensions before invoking Ghostscript when rendering EPS. Applications that process untrusted EPS or PostScript files using an application-selected scale greater than one can incur excessive Ghostscript CPU and temporary disk consumption. In versions with decompression-bomb protection, the scaled output is checked only after Ghostscript has completed rendering.

Pillow versions 11.2.1 through 13.0.0 incorrectly assume image rows are tightly contiguous when exporting to Arrow. When PILLOW_ALIGNMENT causes row padding or an aligned offset before the first row, the resulting Arrow buffer may include uninitialized padding, bytes preceding the first row, or stale heap contents from previously freed images. This can disclose one user's pixels or other process memory to another user.