CVE-2026-112900: Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
Critical 9.2 EPSS 1.3% Ghostscript
Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a hyphen can be interpreted as a Ghostscript option. An attacker who controls the filename can inject Ghostscript arguments. Arbitrary command execution specifically requires a leading @ argument-file filename and control of the referenced text file containing additional Ghostscript arguments; the reported chain reproduces with the default -dSAFER invocation. This issue is fixed in version 13.0.0.
- CVE-2026-112900CVE identifier
- 9.2CVSS 4.0 base score (critical)
- 1.3%EPSS: chance of exploitation in the next 30 days (higher than 71% of CVEs)
- 2026-10-19published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run Ghostscript and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- Nothing to restart for CLI use; reload services that call it (CUPS filters, ImageMagick delegates, PHP apps)
Affected and fixed versions
Affected:
- python-pillow Pillow >= 2.6.0, < 13.0.0
Patch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade ghostscript libgs10Ubuntu
sudo apt update
sudo apt install --only-upgrade ghostscript libgs10RHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh ghostscript libgsFedora
sudo dnf upgrade --refresh ghostscript libgsSUSE / openSUSE
sudo zypper refresh
sudo zypper update ghostscriptAmazon Linux
sudo dnf upgrade --releasever=latest ghostscript libgsArch Linux
sudo pacman -SyuAlpine
apk update && apk upgrade ghostscriptFreeBSD
pkg update && pkg upgrade ghostscript10General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | pillow | not fixed yet | |
| Debian 13 | pillow | not fixed yet | |
| Debian testing | pillow | not fixed yet | |
| Ubuntu 18.04 (ESM) | pillow | being checked | |
| Ubuntu 20.04 (ESM) | pillow | being checked | |
| Ubuntu 22.04 | pillow | being checked | |
| Ubuntu 24.04 | pillow | being checked | |
| Ubuntu 26.04 | pillow | being checked | |
| Ubuntu 26.10 | pillow | being checked | |
| Ubuntu 20.04 (ESM) | pillow-python2 | being checked | |
| Red Hat Enterprise Linux 8 | python-pillow-0:5.1.1-36.el8_10 | fixed | RHSA-2026:93077 |
| Red Hat Enterprise Linux 7 | python-pillow | affected | |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
Sources
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-w889-685w-c8fh
- https://github.com/python-pillow/Pillow/commit/a2c363141da31a265dd536c945677db4b64f3ec9
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0
- CVE-2026-112900 on CVE.org
- CVE-2026-112900 on NVD
Page generated automatically from official sources on 2026-11-03 18:05 UTC. Always confirm with your vendor's advisory.