CVE-2026-112398 | Python Pillow up to 12.x FlashPix JPEG-tile decoder ImagingJpegDecode buffer overflow

October 20, 2026 Yanac

A vulnerability marked as critical has been reported in Python Pillow Pillow up to 12.x. Impacted is the function ImagingJpegDecode of the component FlashPix JPEG-tile decoder. Performing a manipulation results in buffer overflow.

This vulnerability is cataloged as CVE-2026-112398. It is possible to initiate the attack remotely. There is no exploit available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More