Free practical cybersecurity guidance for organisations without a security team.
hello@actionsoncyber.com
Actions On Cyber logo
Contact
← Back to Vulnerability Briefs

Critical Security Flaw in Popular Python Image Library Could Let Attackers Run Harmful Code

A serious security weakness has been found in a widely used Python image library called Pillow. This flaw could allow attackers to run harmful commands on systems that process certain image files, posing a risk to organisations using software that relies on this library.

25 October 2026

Reference: CVE-2026-112900

1. What is being reported?

The vulnerability involves the Pillow library, which many software applications use to handle images. When Pillow processes a specific type of image file (EPS), it can be tricked into running dangerous commands if the file name is specially crafted by an attacker. This happens because Pillow does not properly check the file name before passing it to another program called Ghostscript.

2. What this means in plain English

If your organisation uses software that relies on this version of Pillow to handle EPS images, an attacker could potentially exploit this flaw to run harmful commands on your system. This could lead to unauthorised access or damage. However, this requires the attacker to supply a specially crafted image file and for your software to process it.

3. Could this affect a small business?

Small businesses or charities that use software built with Python and the Pillow library to process EPS images might be at risk, especially if they accept image files from outside sources. If you do not use such software or do not handle EPS image files, this vulnerability is unlikely to affect you.

4. What to do now

  • Check with your IT provider or software supplier if your systems use the Pillow library, especially versions between 2.6.0 and 13.0.0.
  • Ensure that any software using Pillow is updated to version 13.0.0 or later, where this vulnerability is fixed.
  • Avoid opening or processing EPS image files from untrusted or unknown sources until the issue is resolved.
  • Ask your IT provider to review your image processing workflows and apply any necessary security updates promptly.

5. Ask your IT provider

Can you confirm whether any of our software uses the Pillow Python library for processing EPS images, and if so, has it been updated to the fixed version 13.0.0 or later to address the recent critical vulnerability?

6. Bottom line

Update any software using the Pillow library to the latest version to prevent attackers from exploiting this critical flaw.

Information based on NVD, CISA KEV, and reputable security news reporting.

Back to Vulnerability Briefs