NewsThe Hacker News
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
Linked advisories
- CVE-2026-112900Pillow: heap buffer overflow in FlashPix (FPX) JPEG decoding lets one crafted image run code (CVE-2026-112398)
- CVE-2026-112900Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
- CVE-2026-112900Python-pillow Pillow: Betriebssystem-Befehlsinjektion
- CVE-2026-112900Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
- CVE-2026-112900Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
- CVE-2026-112900Python-pillow Pillow: Betriebssystem-Befehlsinjektion
Affected vendors and products
More on Execution
Other advisories
- CriticalCVE-2026-116692MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules
- CriticalCVE-2026-116692MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules
- CriticalCVE-2026-111497Google Brotli Remote Code Execution Vulnerability
- CriticalCVE-2026-114053vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
- CriticalCVE-2026-114053vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
- CriticalCVE-2026-110858GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution
- Highghsa:GHSA-f9j4-qggq-h239GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution
- Not ratedCVE-2026-78845Remote Code Execution (RCE) (CVE-2026-78845)
Other news entries
- Hackers Start Probing Fresh Oracle EBS VulnerabilityNewsSecurityWeek
- Code-execution flaw in UEFI firmware affects most servers on planet EarthNewsArs Technica — Security
- HPE Patches Dozens of Critical Flaws in Networking ProductsNewsSecurityWeek
- CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code ExecutionNewsThe Hacker News
- PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution FlawNewsThe Hacker News
- Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python PackagesNewsSecurityWeek
- PHP shares mitigation for new RCE vulnerability with no patchNewsBleepingComputer
- HPE patches eight max severity RCE and auth bypass AOS flawsNewsBleepingComputer
Source: https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html
ID