Bug 2555867 (CVE-2026-112398)

Summary: CVE-2026-112398 pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: anthomas, dschmidt, ehelms, ggainey, jlanda, jpasqual, juwatts, kshier, mdellweg, mhulan, nmoumoul, osousa, pcreech, rbobbitt, rchan, rhel-process-autobot, simaishi, smallamp, stcannon, tmalecek, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Pillow. A remote attacker can achieve arbitrary code execution by supplying a specially crafted FlashPix (FPX) image file to an application that processes untrusted inputs. Due to improper handling of image tile data during JPEG decoding, the library writes pixel data beyond the allocated memory buffer. This out-of-bounds write corrupts heap memory and can allow an attacker to execute arbitrary commands or cause an application crash.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2563091, 2563096, 2563098, 2563094, 2563097    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-19 21:22:24 UTC 
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four components, causing ImagingJpegDecode to write four-component scanlines into the two-byte tile buffer. An attacker can supply a crafted OLE2 FlashPix file to an application with the optional olefile dependency installed that opens or thumbnails untrusted input. This can corrupt heap memory and may allow arbitrary code execution. This issue is fixed in version 13.0.0.
Comment 2 Jon Orris 2026-10-30 19:18:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:93077 https://access.redhat.com/errata/RHSA-2026:93077
Comment 4 Jon Orris 2026-11-05 19:41:05 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.17 for RHEL 9

Via RHSA-2026:95656 https://access.redhat.com/errata/RHSA-2026:95656
Comment 5 Jon Orris 2026-11-05 19:42:47 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.18 for RHEL 9

Via RHSA-2026:95657 https://access.redhat.com/errata/RHSA-2026:95657
Comment 6 Jon Orris 2026-11-05 19:43:04 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.16 for RHEL 8
  Red Hat Satellite 6.16 for RHEL 9

Via RHSA-2026:95655 https://access.redhat.com/errata/RHSA-2026:95655