Pillow CVE-2026-112398 and 13.0.0: what to update

Q: How do I check my Pillow version?

Run python -c "import PIL; print(PIL.__version__)" with the Python your app uses, or pip show pillow. In a container, run the same command inside the image.

Q: What is the CVSS score of CVE-2026-112398?

9.2, Critical, in CVSS 4.0, with the vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, from GitHub as the CVE Numbering Authority. The NVD shows the record as "Undergoing Analysis", with no score of its own.

As of October 24, 2026, 08:38 JST (October 23, 23:38 UTC). Every fact that can change carries the time it was checked, in JST (UTC+9); the changeable ones were read again at 08:37–08:38. This page covers Pillow 13.0.0 and the advisories it fixes.

Pillow 13.0.0, released October 16, 2026, is the only version that fixes CVE-2026-112398, a FlashPix heap overflow that Pillow's advisory says runs code when an app opens one crafted file, and 40 other advisories. Every Pillow up to 12.3.0 is affected. 13.0.0 needs Python 3.11 or later.

On Python 3.10, which reached end of life on October 1, 2026, the update fails without an error: in this page's test, pip install -U pillow kept 12.3.0 and printed only "Requirement already satisfied". Move those projects to Python 3.11 or later first, then install 13.0.0 and restart every process that imports Pillow. The FlashPix bug is reachable only when the optional olefile package is installed; two of the other critical bugs, in JPEG thumbnails and multi-frame images, need nothing extra.

As checked at 08:38 JST on October 24, CISA's Known Exploited Vulnerabilities catalog lists no Pillow CVE, and no source this page read reports attacks. Pillow's advisory for CVE-2026-112398 includes a proof of concept that runs a command on Pillow 12.2.0 inside what it calls a "version-pinned, ASLR-disabled Docker image", with the operating system's address randomization (ASLR) turned off. CISA's rating in the CVE record says Exploitation "poc". GitHub's Advisory Database counts 41 advisories fixed in 13.0.0, 5 of them critical; Pillow's own labels and count differ.

Below: what to install on each Python version and what pip prints, which code paths reach the bugs, the five critical advisories, what to do on Python 3.10, how to check each install path, the packages that hold Pillow below 13, where each distribution stands, and the timeline.

Which version to install

Your Python	What `pip install -U pillow` gives you	Fixed?	What to do
3.11, 3.12, 3.13, 3.14, or 3.15	13.0.0	Yes	Install 13.0.0 and restart
3.10, end of life since October 1, 2026	12.3.0. If 12.3.0 is installed already, pip prints "Requirement already satisfied" and changes nothing	No	Move to Python 3.11 or later, then install 13.0.0
3.9 or older	11.3.0 at most: Pillow 12.0.0 and later need Python 3.10	No	Move to Python 3.11 or later

PyPI lists 13.0.0 with "Requires-Python >=3.11", against ">=3.10" for every 12.x release (checked 07:53 JST), and Pillow's Python support table marks Pillow 13 for Python 3.11 to 3.15 (07:59 JST). The release notes put it in one line: Pillow "has dropped support for Python 3.10, which reached end-of-life in October 2026." Pillow has published no 12.x release since 12.3.0 on July 1, 2026 (PyPI and the repository's tags, 07:53 JST). The next release on Pillow's schedule is 13.1.0, on January 2, 2027, per the release issue opened on October 22.

What pip and uv print on Python 3.10

This page's test ran on October 24 between 07:55 and 08:01 JST, on macOS 26.5.2 (Apple silicon), in fresh virtual environments: Python 3.10.18 with pip 25.1.1, and again with pip 26.2.2; Python 3.12.8 with pip 24.3.1; uv 0.7.19 with Python 3.10.18 and 3.11.13. Pillow 12.3.0 was installed before each upgrade command, except in the new uv environment on 3.11. Both pip versions printed the same lines on Python 3.10.

Command	Python 3.10	Python 3.11 or 3.12
`pip install -U pillow`	"Requirement already satisfied: pillow in ./venv3.10/lib/python3.10/site-packages (12.3.0)", and nothing else. Pillow stays 12.3.0	"Successfully installed pillow-13.0.0" (3.12)
`pip index versions pillow`	"LATEST: 12.3.0". 13.0.0 isn't in the list	"LATEST: 13.0.0" (3.12)
`pip list --outdated`	Doesn't list Pillow	Not run
`pip install "pillow>=13"`	Fails: "ERROR: Ignored the following versions that require a different python version: 13.0.0 Requires-Python >=3.11", then "ERROR: No matching distribution found for pillow>=13"	Installs or keeps 13.0.0 (3.12)
`uv pip install -U pillow`	"Audited 1 package". Pillow stays 12.3.0	"+ pillow==13.0.0" (3.11)
`uv pip install "pillow>=13"`	Fails: "pillow==13.0.0 depends on Python>=3.11, we can conclude that pillow==13.0.0 cannot be used"	Not run

So write the floor, not just -U. With "pillow>=13", an environment still on Python 3.10 fails the install where you can see it, instead of keeping 12.3.0 in silence.

Who is exposed

The bugs sit in Pillow's file parsers and encoders, so the question is whether a file someone else made reaches them. That covers upload handlers, thumbnail workers, avatar and media pipelines, and AI pipelines that read images users send. Pillow's security page warns that Image.open() "detects format by magic bytes, not file extension or MIME type": a file named avatar.png can still reach the FlashPix, TIFF, or JPEG 2000 parser. Each row below is from the advisory it names (read 07:52 JST).

What your code does	Advisory it reaches	How to check
Opens uploaded or downloaded files with `Image.open()` while `olefile` is installed	CVE-2026-112398. The advisory: "any service that opens or thumbnails untrusted uploads with the optional `olefile` dependency installed is reachable with no user interaction"	`pip show olefile`. In this page's test with Pillow 12.3.0, `"FPX" in Image.OPEN` after `Image.init()` was `False` without `olefile` and `True` with it
Makes thumbnails of uploaded JPEGs with `thumbnail()`, or calls `draft()`	CVE-2026-112403, when the thumbnail is half the image's size or smaller. The advisory says `Image.open(..., formats=["JPEG"])` "does not prevent it", because the file is "a standards-compliant JPEG"	Search your code for `thumbnail(` and `draft(`
Reads the frames of uploaded MPO, PSD, DCX, or MIC files with `ImageSequence.Iterator` or `seek()`, on Pillow 11.0.0 or later	CVE-2026-96639. The reporter showed command execution through the MPO path	Search for `ImageSequence` and `.seek(`
Re-saves uploaded images as TIFF into `io.BytesIO`, an HTTP response, or a storage stream	CVE-2026-112393. The advisory: "Saves to real files are unaffected"	Search for `save(` calls that write `"TIFF"` to a `BytesIO`
Opens EPS files under a file name a user chose, with Ghostscript installed	CVE-2026-112900. Ghostscript reads a crafted file name as its own options	`python -c "from PIL import EpsImagePlugin; print(EpsImagePlugin.has_ghostscript())"`
Opens JPEG 2000 files with a Pillow wheel from 11.1.0 to 12.3.0	GHSA-78g4-xqwv-q3g8, in the OpenJPEG library the wheel carries inside it. The advisory: "Because the wheel bundles its own copy, a patched host OS does not help."	`python -c "from PIL import features; print(features.version_codec('jpg_2000'))"` printed 2.5.4 on the 12.3.0 wheel this page tested
Opens only images you made yourself, in build scripts or your own assets	None from outside	Update at your next routine change

The advisories don't say these are the only paths. If outside files reach Pillow at all, update.

The five critical advisories

These are the five that GitHub's Advisory Database rates critical (checked 07:52 JST). The titles are the advisories' own.

CVE and advisory	Bug	Pillow versions affected	What reaches it	Pillow's own label
CVE-2026-112398, GHSA-5x8w-8jj5-q52h	Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution	12.3.0 and older	`Image.open()` of one crafted file, with `olefile` installed	Critical
CVE-2026-112403, GHSA-8g5g-8vmr-9782	Heap buffer overflow in ImagingJpegDecode	12.3.0 and older	`thumbnail()` or `draft()` on a crafted lossless JPEG	High in the advisory; the release notes list it under Critical, with the FlashPix bug
CVE-2026-96639, GHSA-v9pv-5gc8-w2m6	Multi-frame loaders can reuse stale native image storage after mode transitions	11.0.0 to 12.3.0	Reading the frames of a crafted MPO, PSD, DCX, or MIC file	Critical
CVE-2026-112900, GHSA-w889-685w-c8fh	Argument injection in Ghostscript call, potentially leading into RCE	2.6.0 to 12.3.0	An EPS file opened under a file name an attacker chose, with Ghostscript installed	Medium
CVE-2026-112393, GHSA-332p-7hrc-92wf	Heap buffer overflow in `_tiffWriteProc` when saving TIFF to BytesIO	2.0.0 to 12.3.0	Re-saving an uploaded image as TIFF into memory rather than to a file	High

GitHub published the five CVE records as the CVE Numbering Authority between October 19 and 21 (UTC), with a CVSS 4.0 score of 9.2 for four of them and a CVSS 3.1 score of 9.8 for CVE-2026-96639. The NVD lists all five as "Undergoing Analysis", with GitHub's score and none of its own (checked 07:56 JST).

What each advisory says about the outcome, without the attack details:

CVE-2026-112398 (FlashPix). The advisory's proof of concept runs a command on stock Pillow 12.2.0 in a "version-pinned, ASLR-disabled Docker image"; the advisory says address randomization is off "to reduce the system knowledge requirements". Pillow recognizes the file "by content (the OLE2 magic), not by extension". The fix, commit 242a059a, is the same one that fixes CVE-2026-112403.
CVE-2026-112403 (JPEG thumbnails). A lossless JPEG makes the decoder write past its row buffer when draft() asks it to scale down, and the advisory says the overflowing bytes are the image's own pixel values.
CVE-2026-96639 (multi-frame images). The reporter writes that they "demonstrated command execution in matching Python/Pillow runtime profiles through Pillow's documented ImageSequence.Iterator + frame.load() path."
CVE-2026-112900 (Ghostscript). The advisory: "This is not the malicious-EPS-content risk described in Pillow's security policy: the flaw is triggered by the filename". Pillow's default -dSAFER setting doesn't stop it.
CVE-2026-112393 (TIFF into memory). The reproducer crashes the process. The reporter turned it into code execution "Given two addresses leaked by a separate bug", and didn't publish that part.

How many advisories, and why the counts differ

Three sources count them, and they don't match (all checked 07:52–07:53 JST):

Source	Advisories fixed in 13.0.0	Labels
GitHub Advisory Database, the entries GitHub has reviewed	41, added between October 20 and 23 (9, 19, 11, and 2 a day, UTC)	5 critical, 23 high, 13 medium
Pillow's own advisories in its repository	The same 41, published on October 17 (40) and October 19 (1)	2 critical, 13 high, 23 medium, 3 low
Pillow's 13.0.0 release notes, last changed October 21 at 23:52 UTC	43 advisory IDs	Grouped as Critical, High, Medium, and Low

The two IDs only the release notes list are GHSA-xcvg-w56q-r89m ("TIFF encoder heap buffer overflow when tags override the image size", High) and GHSA-wqgw-9xfh-qf2g ("TIFF and Exif IFD parsing memory and CPU amplification from shared tag data", Medium). GitHub's API returns "Not Found" for both. The release notes add: "CVE identifiers will be added to these entries as they are assigned." One of the 41, GHSA-78g4-xqwv-q3g8, has no CVE ID yet.

The gap matters if you count on Dependabot. GitHub's documentation says: "Only advisories reviewed by GitHub trigger alerts." Pillow published the FlashPix advisory on October 17 at 20:36 UTC; GitHub reviewed it on October 23 at 21:55 UTC, six days later.

Every one of the 41 affects 12.3.0. If you run 12.2.0 or older, 13 more advisories, fixed in 12.3.0 and added to GitHub's database on July 20, apply too. 13.0.0 carries both sets.

If you are on Python 3.10

No Pillow release fixes these bugs on Python 3.10, and none has been announced. The fix is to move the project to a supported Python. Python's developer guide lists 3.11, 3.12, and 3.13 as getting security fixes until October 2027, 2028, and 2029, and 3.14 and 3.15 as getting bug fixes (checked 07:55 JST). Other runtimes reach end of life soon too: End of life in November 2026: .NET 8 and 9, PostgreSQL 14.

Move the project to Python 3.11 or later

With uv, a new environment on 3.11 took 13.0.0 on the first try in this page's test: uv venv -p 3.11, then uv pip install -U pillow printed "+ pillow==13.0.0".
In a uv project whose pyproject.toml says requires-python = ">=3.10", uv lock wrote both versions into uv.lock: 12.3.0 for Python before 3.11 and 13.0.0 for 3.11 and later. A deploy on 3.10 installs 12.3.0 from that lock. uv add "pillow>=13" failed with uv's hint: "Consider using a more restrictive requires-python value (like >=3.11)." Raise requires-python to ">=3.11" and lock again.
In Docker, the official images project dropped Python 3.10 on October 6, in a change titled "Drop Python 3.10 (EOL)", and Docker Hub's python:3.10 tags were last updated that day (checked 07:58 JST). Those images don't contain Pillow; your pip install does. Change FROM python:3.10 to 3.11 or later, then rebuild.
On Ubuntu 22.04, the default python3 is 3.10.6 (Launchpad, 08:00 JST), so a virtual environment made from it gets Pillow 12.3.0 from pip.

Or wait for your distribution

Distributions patch the Pillow they ship, under their own version numbers, and none has shipped these fixes for a stable release yet. Debian's unstable branch has 13.0.0; Ubuntu hasn't triaged them. The table below has each one.

Until you can move: narrow what Pillow parses

None of these is a fix. Each one keeps some of the bugs out of reach, from Pillow's own security guidance or the advisories:

Pass formats= to Image.open() with only the formats you accept. Pillow's security page recommends it: "pass the formats argument with an allowlist of accepted formats". With a list such as formats=["JPEG", "PNG"], Pillow doesn't try its FlashPix, TIFF, EPS, PSD, DCX, MIC, or JPEG 2000 parsers on the file. It doesn't stop CVE-2026-112403, which arrives as a valid JPEG. Nor does it keep out the MPO path of CVE-2026-96639: in Pillow 12.3.0's code (src/PIL/JpegImagePlugin.py), the JPEG opener returns a multi-frame MPO image when the file says it is one. So with "JPEG" allowed, don't read the frames of uploaded images (ImageSequence, seek()).
Uninstall olefile if nothing else needs it. Pillow's format docs say: "To enable FPX support, you must install olefile."
Refuse EPS uploads. Pillow's security policy: "block EPS input at the application layer unless strictly required."
Save TIFF output to a file path, not to io.BytesIO, per the advisory for CVE-2026-112393.
Run image processing in a separate, sandboxed process, as Pillow's security policy advises "for high-risk deployments".

Check what you run

Where your Pillow comes from	How to check	How to get 13.0.0
pip in a virtual environment	`python -c "import PIL; print(PIL.__version__)"` and `pip show olefile`, with the environment's own Python	`python -m pip install -U "pillow>=13"` on Python 3.11 or later
`requirements.txt` without a pin	`pip freeze` in the running environment, not on your laptop	Add `pillow>=13.0.0`; on Python 3.10 the install then fails instead of keeping 12.3.0
uv project	Look for `name = "pillow"` in `uv.lock`. Two entries mean one of them is for Python before 3.11	Set `requires-python = ">=3.11"`, then `uv lock --upgrade-package pillow` and `uv sync`
Poetry project	Look for `name = "pillow"` in `poetry.lock`	Raise the project's Python constraint to 3.11 or later first. This page didn't test Poetry
conda	`conda list pillow`	conda-forge has 13.0.0 for Python 3.11 to 3.15, and the `anaconda` channel for 3.11 to 3.14 (since October 23, 23:17 UTC)
Docker image	`docker run --rm <image> python -c "import PIL; print(PIL.__version__)"`	Rebuild with `docker build --pull` from a Python 3.11 or later base
A program built with PyInstaller, or any image or bundle built earlier	It carries the Pillow it was built with	Rebuild it
Debian or Ubuntu package `python3-pil`	`dpkg -l python3-pil`	Wait for the distribution's update (table)

If an environment ran pip install with LiteLLM in the same week, also read LiteLLM 1.107.0 compromised on PyPI and Docker: what to do: that one is a malicious release, not a bug, and it is cleaned up differently.

Packages that hold Pillow below 13

On Python 3.11 or later, another package's upper bound can still keep 13.0.0 out. This page read the newest release of 23 packages on PyPI that declare a Pillow requirement (07:59 JST). Two of them hold it back:

Package (newest release)	Its Pillow requirement	What it means
Gradio 6.30.0 (October 8, 2026)	`pillow<13.0,>=8.0`	Can't be installed beside 13.0.0. This page's `pip install --dry-run "gradio==6.30.0" "pillow>=13"` ended in "ResolutionImpossible". A change merged into Gradio's 7.0 branch on October 22 allows Pillow 13 and requires Python 3.11; Gradio 7 isn't released (checked 07:59 JST)
MoviePy 2.2.1 (May 21, 2025)	`pillow<12.0,>=9.2.0`	Holds Pillow below 12
Streamlit 1.66.1 (October 21, 2026)	`pillow<14,>=9.2.0`	Allows 13.0.0
Transformers 5.20.2, `vision` extra	`Pillow<=15.0,>=10.0.1`	Allows 13.0.0
matplotlib 3.11.2, torchvision 0.29.1, scikit-image 0.26.0, ReportLab 5.1.0, imageio 2.38.1, Wagtail 8.0.1, Ultralytics 8.4.184	A lower bound only	Allow 13.0.0

If pip install -U "pillow>=13" reports a conflict with one of these, the package's pin is the reason.

Where each distribution and channel stands

This table holds only what each one shows on its own pages. It is the part of this page that goes stale first.

Channel	13.0.0 or a fix?	What it shows (checked October 24, JST)
PyPI wheels	Yes	13.0.0 since October 16, 22:15 UTC, with wheels for Python 3.11 to 3.15 (07:53)
conda-forge	Yes	13.0.0 since October 19, 13:31 UTC, built for Python 3.11 to 3.15 and not 3.10 (07:57)
`anaconda` channel on anaconda.org	Yes	13.0.0 since October 23, 23:17 UTC (October 24, 08:17 JST), built for Python 3.11 to 3.14 (08:37)
Homebrew `pillow`	Yes	13.0.0 since October 19, with bottles (prebuilt packages) since 22:36 UTC (07:57)
Debian	Unstable only	The security tracker marks CVE-2026-112398 fixed in unstable (`13.0.0-1`, accepted October 20) and vulnerable in bookworm (`9.4.0`), trixie (`11.1.0`), and forky (`12.3.0`). It marks the other October CVEs the same way, except CVE-2026-112405, which it shows fixed in trixie (07:56)
Ubuntu	Not yet	The CVE page, published October 23, marks `pillow` "needs-triage" in every release it lists, 22.04 and 24.04 among them, with priority medium. Ubuntu's newest `pillow` for 22.04 is `9.0.1-1ubuntu0.5`, from September 1 (07:57, Launchpad 08:00)
Fedora	Rawhide only	`python-pillow-13.0.0-1.fc46` in Rawhide since October 17. Fedora 45 and 44 have 12.3.0 and no newer update in Bodhi (07:58)
Alpine	edge only	`py3-pillow` 13.0.0-r0 in edge, built October 22. The newest stable branch, v3.24, has 12.2.0-r0, and v3.23 has 11.3.0-r2 (08:37)
Official `python` Docker images	Not applicable	They contain no Pillow. `python:3.10` gets no more updates (07:58)
Red Hat	Not stated	No CVE page for CVE-2026-112398 (07:58)

Timeline

When (UTC)	When (JST)	What happened
July 1, 2026, 11:53	July 1, 20:53	Pillow 12.3.0 on PyPI, the last release for Python 3.10
October 1	October 1	Python 3.10 reaches end of life
October 6, 17:46	October 7, 02:46	Docker's official images drop Python 3.10
October 16, 22:15	October 17, 07:15	Pillow 13.0.0 on PyPI; the GitHub release follows at 22:37 UTC
October 17, 10:32–20:36	October 17, 19:32 – October 18, 05:36	Pillow publishes 40 advisories in its repository, the FlashPix one last
October 19, 09:47	October 19, 18:47	Pillow publishes the 41st advisory
October 19, 13:31 and 17:17	October 19, 22:31, and October 20, 02:17	13.0.0 on conda-forge, then in Homebrew
October 19, 21:07	October 20, 06:07	GitHub, as CVE Numbering Authority, publishes CVE-2026-112398
October 20, 20:40 – October 23, 21:55	October 21, 05:40 – October 24, 06:55	GitHub's Advisory Database adds the 41 reviewed entries
October 20, no time shown	October 20 or 21	Debian accepts 13.0.0 into unstable
October 22, 21:05	October 23, 06:05	CISA adds its rating to the CVE-2026-112398 record: Exploitation "poc", Automatable "no"
October 23	October 23	Ubuntu publishes its CVE page: needs-triage
October 23, 21:55	October 24, 06:55	GitHub reviews the FlashPix advisory, so Dependabot alerts can start
October 23, 23:17	October 24, 08:17	13.0.0 in the `anaconda` channel on anaconda.org

What else changes in 13.0.0

Besides the Python 3.10 drop, the release notes list these changes that can break existing code. Check yours for them before you deploy:

Saving a 32-bit I mode image as PNG no longer clips its values: "Instead, the image can be converted to another mode before saving", for example to I;16.
Image.Image.get_child_images() moved to ImageFile.ImageFile.get_child_images().
Image._show is removed: use show().
ExifTags.IFD.Makernote is removed: use ExifTags.IFD.MakerNote.
A TIFF directory with the same tag twice now keeps the first value, not the last.

Update Pillow to 13.0.0

1. Find each Python and Pillow you run

In every environment that opens images, run python --version and python -c "import PIL; print(PIL.__version__)" with that environment's own Python: each server, each worker, and each image. You need Python 3.11 or later and Pillow 13.0.0.

2. Move off Python 3.10

Change the Python version in pyproject.toml (requires-python = ">=3.11"), in your Dockerfile's FROM line, and in your CI settings, then create fresh environments. On Python 3.10 no Pillow release has these fixes.

3. Install 13.0.0 with a floor

Run python -m pip install -U "pillow>=13", or uv pip install -U "pillow>=13". The >=13 makes an environment still on Python 3.10 fail where you can see it, instead of keeping 12.3.0.

4. Pin it and clear the blockers

Write pillow>=13.0.0 into requirements.txt, or run uv lock --upgrade-package pillow in a uv project. If the resolver reports a conflict, look for a package that caps Pillow below 13, such as Gradio 6.30.0.

5. Rebuild and restart

Rebuild Docker images with docker build --pull, rebuild frozen programs, and restart every process that imports Pillow: a running process keeps the old Pillow in memory until it restarts.

6. Check again

Run step 1 against the running app. Until every environment shows 13.0.0, keep untrusted files away from the parsers you don't need (how).

Updates to this page

October 24, 2026, 08:38 JST: first version.

This page changes when GitHub or Pillow change the count or the labels, when the two unpublished advisories appear, when Pillow ships 13.0.1 or any 12.x release, when Debian, Ubuntu, Fedora, or Alpine ships a fix for a stable release, when Gradio 7 comes out, and when anything about attacks is reported. The same week: Node.js October 2026 security release: what to update, PHP October 2026 security release: what to update, GitLab CVE-2026-110264: which version to upgrade to and how, and, if your Python app runs on Railway, Railway security incident, October 2026: what to do now.

Frequently asked questions

Is Pillow 12.3.0 vulnerable?

Yes. All 41 advisories fixed in 13.0.0 list 12.3.0 in their affected range, CVE-2026-112398 among them. No 12.x release has the fixes.

What is the latest Pillow version?

13.0.0, released October 16, 2026. On Python 3.10, pip calls 12.3.0 the latest, because 13.0.0 requires Python 3.11 or later.

Does Pillow 13 support Python 3.10?

No. Pillow 13 supports Python 3.11 to 3.15. Python 3.10 reached end of life on October 1, 2026, and Pillow's release notes say it "has dropped support for Python 3.10".

How do I check my Pillow version?

Run python -c "import PIL; print(PIL.__version__)" with the Python your app uses, or pip show pillow. In a container, run the same command inside the image.

Does pip install -U pillow upgrade to 13 on Python 3.10?

No. In this page's test it printed "Requirement already satisfied" and kept 12.3.0, with no warning. pip install "pillow>=13" fails instead, with "No matching distribution found for pillow>=13".

Is CVE-2026-112398 being exploited?

No source checked at 08:38 JST on October 24 reports attacks: CISA's Known Exploited Vulnerabilities catalog doesn't list it. Pillow's advisory includes a proof of concept that runs a command on Pillow 12.2.0 in a "version-pinned, ASLR-disabled Docker image", that is, with the operating system's address randomization turned off. CISA's rating in the CVE record says Exploitation "poc" and Automatable "no".

What is the CVSS score of CVE-2026-112398?

9.2, Critical, in CVSS 4.0, with the vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, from GitHub as the CVE Numbering Authority. The NVD shows the record as "Undergoing Analysis", with no score of its own.

Do I need olefile?

Only if you open FlashPix or MIC files. Pillow's docs say FPX support needs olefile, and without it, Pillow 12.3.0 didn't register the FlashPix opener in this page's test. Removing it shuts that path to CVE-2026-112398, but not the other 40 advisories.

Do I need to update Pillow if I only resize my own images?

Less urgently. The bugs need a crafted file, and your own images aren't one. Update at your next routine change, and before any outside file reaches the code.

Will there be a Pillow 12.3.1 for Python 3.10?

Pillow hasn't announced one. Its next scheduled release is 13.1.0, on January 2, 2027.

Sources

Times are in JST (UTC+9), on October 24, 2026.

GitHub Advisory Database, read through its REST API for pip advisories affecting pillow (07:52, 08:38)
Pillow security advisories (07:52, 08:38), and the advisories GHSA-5x8w-8jj5-q52h, GHSA-8g5g-8vmr-9782, GHSA-v9pv-5gc8-w2m6, GHSA-w889-685w-c8fh, GHSA-332p-7hrc-92wf, and GHSA-78g4-xqwv-q3g8 (07:52; GHSA-5x8w-8jj5-q52h again at 08:37)
Pillow 13.0.0 release notes and their source on main, last changed October 21 at 23:52 UTC (07:53, 08:38)
Pillow 13.0.0 release on GitHub, published October 16 at 22:37 UTC (07:53)
PyPI: pillow and pillow 13.0.0 (07:53, 08:38)
Pillow: Python support, Security, Image.open() (07:59), Image file formats: FPX (08:01), and its security policy (07:59)
Pillow 12.3.0: src/PIL/JpegImagePlugin.py, jpeg_factory (08:37)
Pillow issue #10276: Release Pillow 13.1.0 on January 2, 2027 (08:01)
Python Developer's Guide: Status of Python versions (07:55)
CVE.org: CVE-2026-112398, CVE-2026-112403, CVE-2026-96639, CVE-2026-112900, and CVE-2026-112393 (07:56; CVE-2026-112398 again at 08:38)
NVD: CVE-2026-112398 and the other four (07:56; CVE-2026-112398 again at 08:38)
CISA Known Exploited Vulnerabilities catalog, version 2026.10.23 (07:56, 08:38)
GitHub Docs: About Dependabot alerts (08:01)
Debian security tracker: CVE-2026-112398 and source package pillow (07:56, 08:38), and Debian package news for pillow (08:01)
Ubuntu: CVE-2026-112398 (07:57, 08:38), and Launchpad's published sources of pillow and python3-defaults for 22.04 (08:00)
Fedora Bodhi: python-pillow updates (07:58, 08:38)
Alpine packages: py3-pillow (07:58, 08:37)
conda-forge: pillow and its feedstock, and the anaconda channel's pillow (07:57, 08:37)
Homebrew: pillow and its formula history (07:57, 08:38)
Red Hat: CVE-2026-112398, no page (07:58, 08:38)
Docker Hub: python tags, and docker-library/python pull request #1133, merged October 6 (07:58, 08:38)
PyPI: gradio, moviepy, streamlit, transformers, and the other packages in the table (07:59; Gradio again at 08:38)
Gradio issue #13999 and pull request #14005, merged October 22 at 22:14 UTC (07:59)