Bug 2555871 (CVE-2026-112403)

Summary:	CVE-2026-112403 pillow: Pillow: Heap buffer overflow in ImagingJpegDecode
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	alinfoot, anpicker, anthomas, aprice, bbrownin, cmyers, dfreiber, dnakabaa, doconnor, drow, dschmidt, dtrifiro, ebourniv, ehelms, ggainey, hasun, ilpinto, jburrell, jfula, jlanda, jmitchel, jowilson, jpasqual, jsamir, juwatts, jwong, kaycoth, kshier, lcouzens, ltomasbo, mdellweg, mhayden, mhulan, mwoodson, nmoumoul, nyancey, oezr, omaciel, ometelka, osousa, pcreech, ptisnovs, rbobbitt, rchan, rhel-process-autobot, sbunciak, sdoran, simaishi, smallamp, stcannon, syedriko, tmalecek, vkumar, watson-tool-maintainers, weaton, xdharmai, yguenane, ykashtan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Pillow. A remote attacker could exploit this vulnerability to achieve arbitrary code execution or cause a Denial of Service (DoS) by supplying a specially crafted lossless JPEG image to an application that downscales images or generates thumbnails. This issue occurs because the JPEG decoder fails to verify actual output dimensions against the allocated memory buffer during scaling, causing full-width image data to be written beyond buffer boundaries. Successful exploitation leads to heap memory corruption, resulting in an application crash or potential code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2563179, 2563180, 2563181, 2563182, 2563183
Bug Blocks:

Description OSIDB Bzimport 2026-10-19 21:42:21 UTC

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can ignore the requested downscaling geometry. An attacker can supply such a JPEG to an application that uses draft() or thumbnail() to request downscaling. This can corrupt heap memory, crash the process, or potentially allow code execution. Older libjpeg-turbo 2.x and IJG builds reject the SOF3 input. This issue is fixed in version 13.0.0.