Pillow EUVD-2026-104634

Exploitation requires the target application to (1) have Pillow installed WITH the optional 'olefile' dependency present - olefile is not a default Pillow dependency, so this is a significant limiting factor - and (2) open or thumbnail an attacker-supplied OLE2 FlashPix (FPX) file. The specific trigger is a crafted FlashPix JPEG tile whose JPEG mode is unrecognized so libjpeg decodes it as JCS_UNKNOWN with four components, overflowing the two-byte-per-pixel (raw mode LA) tile buffer. No authentication is required (PR:N) and no explicit user interaction is encoded in the CVSS vector (UI:N), but the CVSS-assessed HIGH attack complexity reflects the crafting and heap-grooming effort needed, and exposure is confined to applications that process untrusted FlashPix input.

This is a genuinely high-severity memory-corruption flaw (CWE-122 heap buffer overflow) that can lead to arbitrary code execution, and the fix is confirmed by a vendor security advisory (GHSA-5x8w-8jj5-q52h), a patch commit, and the 13.0.0 release. The provided CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.2) indicates a network-reachable, unauthenticated path with full confidentiality/integrity/availability impact, but notably rates attack complexity HIGH - consistent with the need to craft a FlashPix file that coerces libjpeg into JCS_UNKNOWN four-component decoding and to turn resulting heap corruption into reliable code execution. Two signals temper the raw score: (1) the vulnerable code path is only reachable when the OPTIONAL olefile dependency is installed, so many Pillow deployments are not exposed by default, and (2) no EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization - only a confirmed, patched bug. Net: a real priority for any service that thumbnails or opens untrusted images with olefile present, but not an in-the-wild emergency on the current evidence. EPSS is absent (not low) - exploitation probability cannot be quantified from the provided data.

An attacker uploads a crafted OLE2 FlashPix (.fpx) file to a web application or image-processing pipeline that uses Pillow with the optional olefile dependency installed to open or generate thumbnails of user-supplied images. When Pillow decodes the embedded JPEG tile, an unrecognized JPEG mode is decoded as JCS_UNKNOWN with four components and written into a two-byte-per-pixel LA tile buffer, corrupting the heap; a successful groom can escalate this to arbitrary code execution in the service process. No public exploit code is identified at time of analysis, and the high attack complexity means reliable RCE requires non-trivial heap manipulation.