CVE-2026-112403

A flaw was found in Pillow. A remote attacker could exploit this vulnerability to achieve arbitrary code execution or cause a Denial of Service (DoS) by supplying a specially crafted lossless JPEG image to an application that downscales images or generates thumbnails. This issue occurs because the JPEG decoder fails to verify actual output dimensions against the allocated memory buffer during scaling, causing full-width image data to be written beyond buffer boundaries. Successful exploitation leads to heap memory corruption, resulting in an application crash or potential code execution.

The overflow only triggers when the application calls draft() or thumbnail() before loading the image. Direct Image.open().load() or Image.open().resize() decode at scale 1 and are unaffected. Many image processing pipelines use load() followed by resize(), not thumbnail(). The libjpeg-turbo 3.x requirement, specific code path, and dimension threshold make this not easily exploitable across the entire Pillow install base.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.