A FlashPix file runs code when opened, if olefile is installed

Heap buffer overflow in FlashPix (FPX) JPEG-tile decoding leads to code execution.

Advisory

CVE-2026-112398 (also GHSA-5x8w-8jj5-q52h)

Library

Pillow, pillow on PyPI

Published

2026-10-23

Severity

9.2 out of 10, as published

Affected

<= 12.3.0

Fixed in

13.0.0

Reaches you

by opening a file

What triggers it

A single crafted FlashPix file, recognised by its OLE2 bytes, opened with Image.open() on an installation with the optional olefile package.

What sillybos does

Refused by default

sillybos refuses the triggering file under its default policy, through the formats check.

OLE (which carries FlashPix and old Office files) is refused by name from the first bytes.

Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:

• tests/test_check.py::TestHostileFiles::test_a_renamed_ole_file

How to protect yourself

In general. Upgrade to Pillow 13.0.0. Do not install olefile where it is not needed.

Specifically. formats=[...] on Image.open, or sillybos in front of it.

The general advice applies to every row here.

Sources

• https://github.com/advisories/GHSA-5x8w-8jj5-q52h
• The record entry, triaged 2026-11-01, last checked 2026-11-01