Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 8.1, published 22 October 2026.

Which products and versions are affected?

Pillow contributors Pillow 11.1.0, 11.2.1, 11.3.0, 12.0.0 through 12.3.0; pillow (PyPI) >= 11.1.0, < 13.0.0, ECOSYSTEM:introduced=11.1.0,fixed=13.0.0.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Pillow contributors Pillow or pillow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Pillow heap buffer overflow in bundled libopenjp2

Q: Is there a fix for This vulnerability?

Yes. pillow (PyPI): upgrade to 13.0.0 or later. Until then: Apply format allowlist validation to Image.open() by passing the formats= parameter and validating against detected magic bytes rather than client-supplied filename or Content-Type headers, as format sniffing bypasses extension-based checks. Restrict image processing endpoints to accept only necessary formats, explicitly excluding JPEG 2000 if not required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Severity: high · CVSS 8.1 · Published 2026-10-22

Pillow, a widely-used Python image processing library, bundles a vulnerable version of the JPEG 2000 decoder that can be exploited through Image.open() with a crafted image file. An attacker can trigger an out-of-bounds heap write, crash the application, or potentially achieve code execution by corrupting heap metadata and hijacking function pointers. This affects any service that processes user-supplied images without strict format validation.

Technologies: pillow (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 8.1, published 22 October 2026.
Which products and versions are affected?: Pillow contributors Pillow 11.1.0, 11.2.1, 11.3.0, 12.0.0 through 12.3.0; pillow (PyPI) >= 11.1.0, < 13.0.0, ECOSYSTEM:introduced=11.1.0,fixed=13.0.0.
Is there a fix for This vulnerability?: Yes. pillow (PyPI): upgrade to 13.0.0 or later. Until then: Apply format allowlist validation to Image.open() by passing the formats= parameter and validating against detected magic bytes rather than client-supplied filename or Content-Type headers, as format sniffing bypasses extension-based checks. Restrict image processing endpoints to accept only necessary formats, explicitly excluding JPEG 2000 if not required.</anigation> </invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Pillow contributors Pillow or pillow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pillow (PyPI): upgrade to 13.0.0 or later
```
pip install "pillow>=13.0.0"
```

Apply format allowlist validation to Image.open() by passing the formats= parameter and validating against detected magic bytes rather than client-supplied filename or Content-Type headers, as format sniffing bypasses extension-based checks. Restrict image processing endpoints to accept only necessary formats, explicitly excluding JPEG 2000 if not required.</anigation> </invoke>

Technical details

An unguarded array bounds check in libopenjp2 2.5.3 and 2.5.4 allows an out-of-bounds write in opj_j2k_read_sod when processing a maliciously crafted JPEG 2000 codestream. The vulnerability is reachable from Pillow's default Image.open().load() call without requiring non-default decoder options. The defect lies in the bounds-checking of tp_index array access indexed by an attacker-controlled single-byte TPsot field, with a correct guard pattern already present elsewhere in the same file.

Affected products

Pillow contributors Pillow 11.1.0, 11.2.1, 11.3.0, 12.0.0 through 12.3.0

Timeline

2026-10-22: disclosed: Vulnerability reported to Pillow
2026-02-10: patched: Upstream OpenJPEG fix committed (91d08b11) but not released

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.