Pillow 13.0.0 Fixes High-Severity Heap Overflow in JPEG Encoder

Pillow version 13.0.0 has been released to remediate CVE-2026-96778, a high-severity heap buffer overflow in the JPEG encoder. This update resolves a critical issue where applications could crash or potentially execute arbitrary code when processing specific image files.

What happened

The vulnerability, tracked as CVE-2026-96778, exists in the `ImagingJpegEncode()` function within `src/libImaging/JpegEncode.c`. According to the GitHub advisory GHSA-g7cr-3p24-7wf7, the flaw allows an attacker to write up to 64 KB of chosen bytes beyond a heap buffer. This occurs when a JPEG image is saved while retaining its color profile, specifically when the ICC profile data nearly fills the available buffer space.

The bug arises because the code fails to check if the output buffer has sufficient room before writing a comment marker. When a 65,498-byte ICC profile fills the 65,536-byte buffer, the system stores one byte past the end. This causes a size counter to wrap around, allowing the comment and compressed image data to be written out of bounds. As Patch Gazette reported on 2026-10-21 regarding a different vulnerability, Pillow has a history of addressing critical memory safety issues in its imaging pipelines.

Triggering the flaw requires only a valid JPEG or PNG file with an ICC profile and a comment. The file must be processed using standard Pillow methods, such as `Image.open()` followed by `im.save()` with the `icc_profile` parameter. This is the documented method for preserving color data, meaning no unusual configurations are needed to expose the vulnerability.

Why it matters

The immediate result of exploiting this flaw is a crash, where the Python process is killed outright rather than raising an exception. However, because the overwritten memory sits directly in front of function pointers used by the encoder, the issue could allow remote code execution. While the provided reproducer demonstrates only the crash, the potential for arbitrary memory writes makes this a high-severity risk for any application using Pillow to re-save images.

Applications that accept user-uploaded images and re-save them as JPEGs while keeping their color profiles are the primary targets. Since the flaw is triggered by standard color preservation workflows, many web services and image processing tools may be affected without custom code changes. The severity is rated high by the GitHub advisory, reflecting the potential for memory corruption beyond simple denial of service.

What to watch

• Monitor internal logs for unexpected Python process terminations or SIGSEGV signals in image processing services.
• Check for any anomalies in image output files that might indicate memory corruption or altered data structures.
• Review deployment pipelines to ensure that Pillow version 13.0.0 is successfully integrated into production environments.

Who needs to act first

Teams should prioritize updating systems that expose image processing capabilities to external users or untrusted inputs. Organizations typically start by identifying services that handle JPEG uploads and re-save operations, as these are most likely to trigger the flaw. Before rolling out the update, IT managers usually test the new version in a staging environment to ensure compatibility with existing workflows. Backing up current configurations and image data is a standard precaution before applying patches. If immediate updating is not possible, restricting input to trusted sources reduces exposure while a fix is prepared.

What to do and how to stay safe: Pillow

• Update all instances of the Pillow library to version 13.0.0 or later to mitigate the heap buffer overflow.
• Audit applications for code that saves JPEG images while preserving ICC profiles, as this workflow triggers the vulnerability.
• Implement input validation to reject or sanitize image files with unusually large metadata sections before processing.
• Monitor system logs for sudden application crashes that may indicate exploitation attempts against vulnerable versions.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Pillow are vulnerable to CVE-2026-96778?

Versions 9.4.0 and later, up to but not including 13.0.0, are affected by this heap buffer overflow vulnerability.

Is there a fix available for this vulnerability?

Yes, Pillow version 13.0.0 has been released and contains the patch for CVE-2026-96778.

What is the potential impact of exploiting this flaw?

The flaw can cause a process crash, but it may also allow arbitrary code execution due to memory corruption.