Pillow CVE-2026-112403

Exploitation requires ALL of the following concrete conditions: (1) the target application must call Pillow's draft() or thumbnail() API to request JPEG downscaling; (2) the Pillow build must be linked against libjpeg-turbo 3.x - builds using libjpeg-turbo 2.x or IJG reject the SOF3 input and are not affected; (3) the attacker must supply a crafted 8-bit lossless SOF3-encoded JPEG. The primary limiting factor is the libjpeg-turbo 3.x dependency (a specific, non-universal build configuration), which is why CVSS assigns AC:H. No authentication is required (PR:N) and no explicit user interaction beyond the application ingesting the attacker-supplied image (UI:N), making services that auto-generate thumbnails from untrusted uploads the realistic exposure surface.

This is a genuine heap buffer overflow (CWE-122) in Pillow's JPEG decoder with plausible paths to crash and potential remote code execution, but several signals temper the raw 9.2 CVSS 4.0 score into a conditional rather than universal priority. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) correctly captures high complexity (AC:H): exploitation is NOT universal because it requires the specific combination of a build linked to libjpeg-turbo 3.x AND an 8-bit lossless SOF3 JPEG AND an application calling draft() or thumbnail() to request downscaling - older libjpeg-turbo 2.x and IJG builds reject the input entirely. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vendor advisory (GHSA-8g5g-8vmr-9782) and fixing commit are confirmed, and the committed regression test demonstrates the vulnerable condition, but weaponizing a corrupted heap into reliable code execution is non-trivial. Net: treat as a high-priority patch for any environment that processes untrusted images with Pillow on a libjpeg-turbo 3.x build, but the AC:H prerequisites and absence of exploitation signals suggest this is not yet a mass-exploitation threat.

An attacker uploads a maliciously crafted 8-bit lossless SOF3 JPEG to a web service that uses Pillow's thumbnail() or draft() to downscale user images for previews. On a server whose Pillow is linked against libjpeg-turbo 3.x, libjpeg ignores the requested downscale geometry and emits a full-width scanline into a buffer sized for the smaller draft scale, corrupting the heap. No public exploit code was identified at time of analysis, though the vendor's regression test demonstrates the triggering condition.