Security researchers have disclosed a critical remote code execution (RCE) vulnerability tracked as CVE-2026-112900 in Pillow, the widely used Python imaging library. The flaw stems from improper input validation and memory buffer management during image file parsing, allowing unauthenticated remote attackers to achieve arbitrary code execution by supplying specially crafted malicious image files.\n\nOur latest developer security advisory details the affected library versions, exploit mechanics across automated processing pipelines, and essential upgrade and input sanitization measures.\n\nRead the full technical security breakdown on our official security portal.