Back Sploitus

Exploit for CVE-2026

Sploitus • October 23, 2026

Security researchers have disclosed a critical remote code execution (RCE) vulnerability tracked as CVE-2026-112900 in Pillow, the widely used Python imaging library. The flaw stems from improper input validation and memory buffer management during image file parsing, allowing unauthenticated remote attackers to achieve arbitrary code execution by supplying specially crafted malicious image files.

Our latest developer security advisory details the affected library versions, exploit mechanics across automated processing pipelines, and essential upgrade and input sanitization measures.

Read the full technical security breakdown on our official security portal: [Python Pillow RCE (CVE-2026-112900)](

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Pillow Library Enable Remote Code Execution A critical flaw (CVE-2026-112900) in Python's Pillow image library allows remote code execution via crafted EPS files. The vulnerability arises from improper handling of filenames when Pillow invokes Ghostscript, potentially enabling attackers to execute arbitrary commands. Two additional critical vulnerabilities (CVE-2026-112403 and CVE-2026-112393) involve heap overflows in JPEG and TIFF processing, respectively. All three vulnerabilities received a CVSS score of 9.2 and were disclosed on October 19, 2026. The maintainers released a patch (version 13.0.0) on October 16, 2026, addressing these issues. Pillow is widely used, with an estimated 436 million downloads per month, making it a significant target for exploitation. Currently, no has been reported, but the vulnerabilities could be exploited if not patched. 3 sources 58

Extracted Entities

Exploit for CVE-2026

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)

Tools (1)