CVE-2026-112398

What it actually does

Heap buffer overflow in Pillow's FlashPix JPEG-tile decoder where four-component JCS_UNKNOWN scanlines are written into a two-byte-per-pixel LA tile buffer, corrupting adjacent heap memory.

Why it matters to the business

Attackers may achieve remote code execution on systems processing untrusted images with the olefile dependency present; risk is rising as exploit probability has increased 78% in the last 30 days and the flaw is only seven days old.

How an attack unfolds

An attacker creates a crafted OLE2 FlashPix file containing a JPEG tile decoded as JCS_UNKNOWN, delivers it to an application that uses Pillow to open or thumbnail images, and triggers the decoder mismatch to overflow the tile buffer and execute arbitrary code.

How to fix it

Upgrade Pillow to version 13.0.0 or later; remove the optional olefile dependency if FlashPix support is unnecessary.

How to confirm the fix worked

Verify the installed Pillow version is 13.0.0 or newer; test image processing pipelines with known-good and malformed FlashPix samples under controlled conditions.

Typical attack path

1. Craft a malicious OLE2 FlashPix file with an unrecognized JPEG mode
2. Deliver the file to a target application that depends on Pillow and olefile
3. Trigger image opening or thumbnail generation
4. Cause ImagingJpegDecode to write four-component data into the two-byte buffer
5. Corrupt heap memory to achieve code execution

How to detect it

Review application logs for Pillow image decoding of FlashPix or OLE2 files, monitor for crashes or abnormal memory usage during thumbnail or open operations on untrusted input.

What your security team should do

• Upgrade Pillow to 13.0.0 or later within the next 48 hours given rising EPSS and recent publication
• Audit all applications for Pillow + olefile usage and restrict untrusted image input
• Add runtime checks or sandboxing around image decoding workflows