# SUSE-SU-2026:5038-1: python-Pillow security update

SUSE-SU-2026:5038-1, released November 7, 2026, fixes 29 CVEs in python-Pillow (version 7.2.0-150300.3.33.1). None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/suse-su-2026-5038-1
- Platform: Linux
- Released: Nov 7, 2026
- Priority: Urgent (Closes CVE-2026-112900, rated Critical)
- CVEs: 29, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2026:5038-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [python-Pillow](https://patchblox.com/security/data/product/linux/python-pillow.md) | sles 15.7 | 7.2.0-150300.3.33.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-112900](https://patchblox.com/security/data/cve/CVE-2026-112900.md) | Urgent | python-Pillow: argument Injection in Ghostscript call can lead to remote code execution (bsc#1286397). | 8.1 | 0.0130 |  |
| [CVE-2026-112393](https://patchblox.com/security/data/cve/CVE-2026-112393.md) | Urgent | python-Pillow: heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data | 8.1 | 0.0102 |  |
| [CVE-2026-112398](https://patchblox.com/security/data/cve/CVE-2026-112398.md) | Urgent | python-Pillow: heap buffer overflow in FPX JPEG decoding can lead to code execution (bsc#1286406). | 8.1 | 0.0070 |  |
| [CVE-2026-96640](https://patchblox.com/security/data/cve/CVE-2026-96640.md) | High | python-Pillow: PDF append accepts malformed shared page-tree DAG, which can cause resource exhaustion (bsc#1286798). | 7.5 | 0.0060 |  |
| [CVE-2026-112402](https://patchblox.com/security/data/cve/CVE-2026-112402.md) | High | python-Pillow: Denial of service via double free during image transformation (bsc#1286381). | 7.5 | 0.0059 |  |
| [CVE-2026-112405](https://patchblox.com/security/data/cve/CVE-2026-112405.md) | High | python-Pillow: NULL pointer dereference in `Image.merge` via an unvalidated band 0 (bsc#1286404). | 7.5 | 0.0059 |  |
| [CVE-2026-112894](https://patchblox.com/security/data/cve/CVE-2026-112894.md) | High | python-Pillow: Denial of Service via crafted multi-frame image conversion (bsc#1286408). | 7.5 | 0.0059 |  |
| [CVE-2026-112895](https://patchblox.com/security/data/cve/CVE-2026-112895.md) | High | python-Pillow: Denial of service via crafted PDF during append operations (bsc#1286411). | 7.5 | 0.0059 |  |
| [CVE-2026-112392](https://patchblox.com/security/data/cve/CVE-2026-112392.md) | High | python-Pillow: Denial of Service via zero-size images in rank filters (bsc#1286287). | 7.5 | 0.0059 |  |
| [CVE-2026-112390](https://patchblox.com/security/data/cve/CVE-2026-112390.md) | High | python-Pillow: Denial of Service via infinite loop during crafted MIC image parsing (bsc#1286256). | n/a | 0.0059 |  |
| [CVE-2026-112391](https://patchblox.com/security/data/cve/CVE-2026-112391.md) | High | python-Pillow: Denial of Service via unbounded recursion in PDF parser (bsc#1286273). | 7.5 | 0.0058 |  |
| [CVE-2026-112397](https://patchblox.com/security/data/cve/CVE-2026-112397.md) | High | python-Pillow: out-of-bounds access in `_imagingmorph` on a zero-width image (bsc#1286314). | 7.5 | 0.0057 |  |
| [CVE-2026-112406](https://patchblox.com/security/data/cve/CVE-2026-112406.md) | High | python-Pillow: infinite loop in `PdfParser.rewrite_pages` on page tree `Parent` cycle (bsc#1286403). | 7.5 | 0.0057 |  |
| [CVE-2026-112901](https://patchblox.com/security/data/cve/CVE-2026-112901.md) | High | python-Pillow: ReDoS in `XbmImagePlugin` can be triggered by 512-byte file (bsc#1286396). | n/a | 0.0053 |  |
| [CVE-2026-112399](https://patchblox.com/security/data/cve/CVE-2026-112399.md) | High | python-Pillow: Denial of service via crafted APNG image (bsc#1286368). | n/a | 0.0053 |  |
| [CVE-2026-112892](https://patchblox.com/security/data/cve/CVE-2026-112892.md) | High | python-Pillow: MSP RLE decoder expands a tiny file into unbounded memory (bsc#1286401). | 7.5 | 0.0050 |  |
| [CVE-2026-112897](https://patchblox.com/security/data/cve/CVE-2026-112897.md) | High | python-Pillow: `TiffDecode` returns uninitialized memory as pixels for short JPEG strips (bsc#1286398). | n/a | 0.0048 |  |
| [CVE-2026-112896](https://patchblox.com/security/data/cve/CVE-2026-112896.md) | High | python-Pillow: TIFF encoder `ColorMap` plane-size mismatch causes a heap out-of-bounds read (bsc#1286400). | n/a | 0.0048 |  |
| [CVE-2026-112403](https://patchblox.com/security/data/cve/CVE-2026-112403.md) | Routine | python-Pillow: heap buffer overflow in `ImagingJpegDecode` allows for code execution (bsc#1286405). | n/a | 0.0095 |  |
| [CVE-2026-112401](https://patchblox.com/security/data/cve/CVE-2026-112401.md) | Routine | python-Pillow: Denial of Service via crafted GIF comments (bsc#1286372). | n/a | 0.0065 |  |
| [CVE-2026-112400](https://patchblox.com/security/data/cve/CVE-2026-112400.md) | Routine | python-Pillow: Denial of Service via memory exhaustion from crafted GIF image (bsc#1286370). | n/a | 0.0059 |  |
| [CVE-2026-112394](https://patchblox.com/security/data/cve/CVE-2026-112394.md) | Routine | python-Pillow: `P;2L` and `P;4L` decoders may read 1 to 3 bytes past the passed buffer size (bsc#1286311). | n/a | 0.0056 |  |
| [CVE-2026-112891](https://patchblox.com/security/data/cve/CVE-2026-112891.md) | Routine | python-Pillow: quadratic GIF comment copying during save (bsc#1286402). | n/a | 0.0055 |  |
| [CVE-2026-112899](https://patchblox.com/security/data/cve/CVE-2026-112899.md) | Routine | python-Pillow: EPS `load(scale)` lets Ghostscript render past the decompression bomb limit (bsc#1286489). | n/a | 0.0054 |  |
| [CVE-2026-112902](https://patchblox.com/security/data/cve/CVE-2026-112902.md) | Routine | python-Pillow: memory disclosure and segfault in libtiff encoder via crafted TIFF tags (bsc#1286804). | n/a | 0.0050 |  |
| [CVE-2026-96637](https://patchblox.com/security/data/cve/CVE-2026-96637.md) | Routine | python-Pillow: decompression bomb check bypass in `SpiderImagePlugin.seek()` leads to unbounded allocation DoS | n/a | 0.0037 |  |
| [CVE-2026-96636](https://patchblox.com/security/data/cve/CVE-2026-96636.md) | Routine | python-Pillow: decompression-bomb protection bypass via multi-frame `seek()` in MPO and DCX (bsc#1286802). | n/a | 0.0035 |  |
| [CVE-2026-96641](https://patchblox.com/security/data/cve/CVE-2026-96641.md) | Routine | python-Pillow: reachable undefined behavior in native integer operations can lead to denial of service or logic | n/a | 0.0035 |  |
| [CVE-2026-96642](https://patchblox.com/security/data/cve/CVE-2026-96642.md) | Routine | python-Pillow: `TarIO` negative size field causes infinite CPU-spin loop (bsc#1286796). | n/a | 0.0035 |  |

---

Data as of 2026-11-11T01:43:54Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.