Welcome To openEuler Community
Hey @fundawang , thanks for your contribution to the community.
Bot Usage Manual
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands. You can self-configure the PR merge rules for this repository. For more details, please refer to Here.
Contact Guide
If you have any questions, please contact the SIG: sig-python-modules ,
and any of the maintainers: @shinwell_hu, @yangzhao_kl ,
and any of the committers: @cherry530, @randy1568, @starlet-dx .
/get-cve
@yangwei999 CVE信息从NVD同步成功, 稍后请重新加载页面.
openeuler-ci-bot影响性分析说明：
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can ignore the requested downscaling geometry. An attacker can supply such a JPEG to an application that uses draft() or thumbnail() to request downscaling. This can corrupt heap memory, crash the process, or potentially allow code execution. Older libjpeg-turbo 2.x and IJG builds reject the SOF3 input.
补充说明：issue 的「漏洞归属的版本」为 CPE 字典列表，非官方受影响范围；官方受影响版本为 < 13.0.0（13.0.0 修复，上游修复 commit 242a059aedc1935097d9aa1dc3f099750467ba75，GHSA-8g5g-8vmr-9782；注意利用需构建链接 libjpeg-turbo 3.x，旧版 2.x/IJG 会拒绝 SOF3 输入）。master 分支已经 PR #297 升级至 13.0.0 完成修复；其余分支（9.0.1/10.3.0）在受影响范围内，backport/升级 PR 尚未合入。
openEuler评分：9.2 Critical
BaseScore: 9.2
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
受影响版本排查(受影响/不受影响)：
1.master(13.0.0): 受影响
2.openEuler-20.03-LTS-SP4(9.0.1): 受影响
3.openEuler-22.03-LTS-SP4(9.0.1): 受影响
4.openEuler-24.03-LTS-Next(10.3.0): 受影响
5.openEuler-24.03-LTS-SP1(10.3.0): 受影响
6.openEuler-24.03-LTS-SP3(10.3.0): 受影响
7.openEuler-24.03-LTS-SP4(10.3.0): 受影响
修复是否涉及abi变化(是/否)：
1.master(13.0.0): 否
2.openEuler-20.03-LTS-SP4(9.0.1): 否
3.openEuler-22.03-LTS-SP4(9.0.1): 否
4.openEuler-24.03-LTS-Next(10.3.0): 否
5.openEuler-24.03-LTS-SP1(10.3.0): 否
6.openEuler-24.03-LTS-SP3(10.3.0): 否
7.openEuler-24.03-LTS-SP4(10.3.0): 否
原因说明：
1.master(13.0.0): 正常修复
2.openEuler-20.03-LTS-SP4(9.0.1): 暂不修复-暂无解决方案或补丁
3.openEuler-22.03-LTS-SP4(9.0.1): 暂不修复-暂无解决方案或补丁
4.openEuler-24.03-LTS-Next(10.3.0): 暂不修复-暂无解决方案或补丁
5.openEuler-24.03-LTS-SP1(10.3.0): 暂不修复-暂无解决方案或补丁
6.openEuler-24.03-LTS-SP3(10.3.0): 暂不修复-暂无解决方案或补丁
7.openEuler-24.03-LTS-SP4(10.3.0): 暂不修复-暂无解决方案或补丁
@cherry530 经过 cve-manager 解析, 已分析的内容如下表所示:
| 状态 | 分析项目 | 内容 |
|---|---|---|
| 已分析 | 1.影响性分析说明 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can ignore the requested downscaling geometry. An attacker can supply such a JPEG to an application that uses draft() or thumbnail() to request downscaling. This can corrupt heap memory, crash the process, or potentially allow code execution. Older libjpeg-turbo 2.x and IJG builds reject the SOF3 input.补充说明:issue 的「漏洞归属的版本」为 CPE 字典列表，非官方受影响范围；官方受影响版本为 < 13.0.0（13.0.0 修复，上游修复 commit 242a059aedc1935097d9aa1dc3f099750467ba75，GHSA-8g5g-8vmr-9782；注意利用需构建链接 libjpeg-turbo 3.x，旧版 2.x/IJG 会拒绝 SOF3 输入）。master 分支已经 PR #297 升级至 13.0.0 完成修复；其余分支（9.0.1/10.3.0）在受影响范围内，backport/升级 PR 尚未合入。 |
| 已分析 | 2.openEulerScore | 9.2 |
| 已分析 | 3.openEulerVector | AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| 已分析 | 4.受影响版本排查 | master:受影响,openEuler-20.03-LTS-SP4:受影响,openEuler-22.03-LTS-SP4:受影响,openEuler-24.03-LTS-Next:受影响,openEuler-24.03-LTS-SP1:受影响,openEuler-24.03-LTS-SP3:受影响,openEuler-24.03-LTS-SP4:受影响 |
| 已分析 | 5.是否涉及abi变化 | master:否,openEuler-20.03-LTS-SP4:否,openEuler-22.03-LTS-SP4:否,openEuler-24.03-LTS-Next:否,openEuler-24.03-LTS-SP1:否,openEuler-24.03-LTS-SP3:否,openEuler-24.03-LTS-SP4:否 |
| 已分析 | 6.原因说明 | master:正常修复,openEuler-20.03-LTS-SP4:暂不修复-暂无解决方案或补丁,openEuler-22.03-LTS-SP4:暂不修复-暂无解决方案或补丁,openEuler-24.03-LTS-Next:暂不修复-暂无解决方案或补丁,openEuler-24.03-LTS-SP1:暂不修复-暂无解决方案或补丁,openEuler-24.03-LTS-SP3:暂不修复-暂无解决方案或补丁,openEuler-24.03-LTS-SP4:暂不修复-暂无解决方案或补丁 |
请确认分析内容的准确性, 确认无误后, 您可以进行后续步骤, 否则您可以继续分析.
经过cve-manager解析，所有PR均已合入
一、漏洞信息
漏洞编号：CVE-2026-112403
漏洞归属组件：python-pillow
漏洞归属的版本：10.0.0,10.3.0,10.4.0,11.1.0,12.3.0,13.0.0,5.3.0,7.2.0,8.1.1,8.1.2,9.0.1,9.3.0
CVSS评分：
BaseScore：9.8 Critical
Vector：CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
漏洞简述：
Pillow is a Python imaging library. Prior to 13.0.0, Pillow s JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg s actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can ignore the requested downscaling geometry. An attacker can supply such a JPEG to an application that uses draft() or thumbnail() to request downscaling. This can corrupt heap memory, crash the process, or potentially allow code execution. Older libjpeg-turbo 2.x and IJG builds reject the SOF3 input. This issue is fixed in version 13.0.0.
漏洞公开时间：2026-10-20 06:17:07
漏洞创建时间：2026-10-26 15:03:06
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2026-112403
更多参考(点击展开)
漏洞分析指导链接：
https://atomgit.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
七彩瞬析开源风险感知平台
漏洞补丁信息：
详情(点击展开)
二、漏洞分析结构反馈
影响性分析说明：
Pillow is a Python imaging library. Prior to 13.0.0, Pillow s JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg s actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can ignore the requested downscaling geometry. An attacker can supply such a JPEG to an application that uses draft() or thumbnail() to request downscaling. This can corrupt heap memory, crash the process, or potentially allow code execution. Older libjpeg-turbo 2.x and IJG builds reject the SOF3 input.补充说明:issue 的「漏洞归属的版本」为 CPE 字典列表，非官方受影响范围；官方受影响版本为 < 13.0.0（13.0.0 修复，上游修复 commit 242a059aedc1935097d9aa1dc3f099750467ba75，GHSA-8g5g-8vmr-9782；注意利用需构建链接 libjpeg-turbo 3.x，旧版 2.x/IJG 会拒绝 SOF3 输入）。master 分支已经 PR #297 升级至 13.0.0 完成修复；其余分支（9.0.1/10.3.0）在受影响范围内，backport/升级 PR 尚未合入。
openEuler评分：
9.2
Vector：CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
受影响版本排查(受影响/不受影响)：
1.master(13.0.0):受影响
2.openEuler-20.03-LTS-SP4(9.0.1):受影响
3.openEuler-22.03-LTS-SP4(9.0.1):受影响
4.openEuler-24.03-LTS-Next(10.3.0):受影响
5.openEuler-24.03-LTS-SP1(10.3.0):受影响
6.openEuler-24.03-LTS-SP3(10.3.0):受影响
7.openEuler-24.03-LTS-SP4(10.3.0):受影响
修复是否涉及abi变化(是/否)：
1.master(13.0.0):否
2.openEuler-20.03-LTS-SP4(9.0.1):否
3.openEuler-22.03-LTS-SP4(9.0.1):否
4.openEuler-24.03-LTS-Next(10.3.0):否
5.openEuler-24.03-LTS-SP1(10.3.0):否
6.openEuler-24.03-LTS-SP3(10.3.0):否
7.openEuler-24.03-LTS-SP4(10.3.0):否
原因说明：
1.master(13.0.0):正常修复
2.openEuler-20.03-LTS-SP4(9.0.1):暂不修复-暂无解决方案或补丁
3.openEuler-22.03-LTS-SP4(9.0.1):暂不修复-暂无解决方案或补丁
4.openEuler-24.03-LTS-Next(10.3.0):暂不修复-暂无解决方案或补丁
5.openEuler-24.03-LTS-SP1(10.3.0):暂不修复-暂无解决方案或补丁
6.openEuler-24.03-LTS-SP3(10.3.0):暂不修复-暂无解决方案或补丁
7.openEuler-24.03-LTS-SP4(10.3.0):暂不修复-暂无解决方案或补丁