CVE-2026-112403

JpegImageFile.draft() — which Image.thumbnail() calls automatically — requests 1/2, 1/4 or 1/8 scaled JPEG output and shrinks self._size and the tile extents to match, so _setimage() allocates a single-row decode buffer of ceil(W/s) samples. ImagingJpegDecode() sets cinfo.scale_num/scale_denom, calls jpeg_start_decompress(), and then reads scanlines into that buffer without ever comparing cinfo.

No known exploitation

Severity

Critical, CVSS 9.2 (v4.0)

EPSS

0.32% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)

Affected packages

• Pillow (pip) <= 12.3.0, fixed in 13.0.0 · GHSA-8g5g-8vmr-9782