Skip to content

Upstream Security Advisory · 24 October 2026

Pillow 13.0.0 Security Fixes: Already Patched in Saphira Linux

Upstream Pillow published three CRITICAL fixes in Pillow 13.0.0 on 19 October 2026. Saphira ships the fixed release as a verified native package. Pillow is a library: upgrade it, then restart or redeploy any Python application that processes images.

Saphira Linux dragon mascot

What Saphira Pillow users should do

Affected component
Upstream Pillow imaging library (used by OpenStack Horizon, among others)
Verified package
python-pillow-13.0.0-r1 in the current Hatched repository; the published APK signature validates against Saphira's repository key.
Fixed status
Fixed in the Saphira-packaged Pillow 13.0.0 line.
Service activation
Restart or redeploy Python applications that process images after upgrading, so they load the corrected library. There is no daemon to restart for Pillow itself.
apk update
apk upgrade

apk update refreshes repository metadata and apk upgradeinstalls available upgrades. Only applications that handle images need attention afterwards.

What these vulnerabilities are

These are upstream Pillow defects, not defects originating in Saphira Linux. All three carry a CVSS 4.0 base score of 9.2 (Critical) and are fixed by the Pillow 13.0.0 upgrade, which Saphira builds natively against its own libjpeg-turbo, zlib, libpng and FreeType — no bundled image libraries.

  • CVE-2026-112900 (Critical): EPS Ghostscript argument injection: a caller-controlled input filename beginning with a hyphen could be interpreted as a Ghostscript option (EpsImagePlugin now resolves the file to a safe absolute path).
  • CVE-2026-112393 (Critical, libtiff-backed TIFF paths): Heap buffer overflow and stale-heap disclosure when saving compressed TIFF data through libtiff to targets without a usable file descriptor. Saphira ships system libtiff and links it, so the fixed decoder path is live here and covered by the upgrade.
  • CVE-2026-112403 (Critical, libjpeg-turbo 3.x interaction): JPEG decoder could write a full-width scanline into a draft-scale buffer for 8-bit lossless SOF3 images decoded against libjpeg-turbo 3.x (which Saphira ships), corrupting heap memory. The decoder now verifies the actual output geometry.

Two exposure notes specific to Saphira builds: Ghostscript is packaged (headless, X/CUPS-free) so EPS rendering works end to end through the fixed argument handling, and system libtiff is linked, so the fixed TIFF decoder path is live rather than absent.

Scope and fixed versions

  • Pillow 13.0.0, verified as Saphira's signed python-pillow-13.0.0-r1 package, built as a native wheel against the Saphira toolchain and staged without network access.
  • Confirmed native features in the shipped binary: JPEG (via system libjpeg-turbo 3.1.2), zlib and FreeType. No libtiff linkage anywhere in the closure.
  • OpenStack Horizon takes an unpinned python-pillow dependency and resolves to the fixed release with no recipe change.

How this was verified

Before publishing, we confirmed the signed package installs cleanly, reports version 13.0.0, imports with all required native features present, and round-trips PNG, JPEG, BMP, GIF and PPM images. ELF linkage was checked to contain only the system image libraries, and the three upstream fix commits were confirmed present in the vendored 13.0.0 sources.

The TIFF case is covered by the upgrade itself: the fixed libtiff-backed decoder path ships in these binaries, and the Saphira libtiff, Ghostscript, OpenJPEG and EXIF tool recipes are packaged alongside for full format support.

Authoritative references

Need help maintaining Python services?

AKADATA LIMITED provides Python maintenance, security updates, code reviews, performance improvements and application modernisation. Contact us if your infrastructure or application needs engineering assistance.

This is an optional commercial service, not a requirement for using Saphira Linux. Contact AKADATA LIMITED support →