psf-pillow-oct2026-check(8)

Script: /opt/psf-security-patches/pillow/pillow-oct2026-check.sh. Tool page: Pillow. Source. With the package installed: man psf-pillow-oct2026-check.

Pillow 13.0.0 security release: read-only checker  (v1)
CVE-2026-96639  (stale image storage reused after mode transitions, CVSS 9.8)
CVE-2026-112900 (EPS filename argument injection into Ghostscript)

If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation

Pillow 13.0.0 (announced 21 October 2026) fixes a long list of memory-safety and
parsing bugs in the most widely installed Python imaging library. Two of
them are covered here.

  CVE-2026-96639  Multi-frame loaders can keep an allocation made for a narrow
                  frame mode while a later frame of the same size switches to
                  wider RGB or CMYK data. Crafted PSD, MPO, DCX or MIC files
                  then write past the allocation. The MPO path can also read
                  out of bounds and, in demonstrated runtime-specific cases,
                  run commands. Affected: 11.0.0 up to 13.0.0.
  CVE-2026-112900 EpsImagePlugin passes the caller-supplied filename after -f
                  to Ghostscript without making it absolute. A name that
                  starts with a hyphen is read as a Ghostscript option, and a
                  name that starts with @ names an argument file. Command
                  execution needs the attacker to control the filename and
                  the referenced text file. Affected: 2.6.0 up to 13.0.0.

Fixed in 13.0.0 for both. This script is read-only: it finds Pillow in Python
environments (installed dist-info and egg-info metadata) and in lock files,
compares versions, and reports whether Ghostscript is installed, since the
EPS bug needs the gs binary.

Usage:
  ./pillow-oct2026-check.sh [command] [DIR ...]

  check (default)  scan DIR (default /usr/lib /usr/local/lib /opt /srv
                   /var/www /var/lib /home /root) for Pillow installs and
                   lock file pins. Exit 0 = nothing affected, 1 = an affected
                   version was found.
  version          print the script version.

Distribution packages often backport fixes without changing the version
string. For packages owned by dpkg or rpm the script reads the package
changelog and reports a mention of either CVE.
Containers: with no directory argument the check also reads the project files it needs from
running docker and podman containers (SCAN_CONTAINERS=1, the default; 0 skips them), through a
read-only probe, and judges them like host projects. The copies are temporary: a path shown as
.../docker_NAME/PATH is the PATH inside the container NAME.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.