Finance · AI
HONG KONG, Oct 26, 2026 - China (Mainland) counts 664 million micro-drama viewers, 59.0% of its 1.125 billion internet users, according to the China Internet Network Information Center's 57th statistical report. It counts 814 million livestreaming users, 72.3% of the same base. And since 1 September 2026 it counts a comprehensive regulatory regime for the format, the Micro-Drama Development Management Measures issued by the National Radio and Television Administration, backed by a parallel multi-channel distribution rule from five departments that took effect the same day.
The industry that those measures now governs is not the one most coverage describes. It is not a cottage industry of scrappy studios chasing viral hits. It is a sector where artificial intelligence-generated titles account for roughly 60% of output, where the cultural and related industries as a whole generated RMB 6.2094 trillion in 2024, equal to 4.61% of GDP, and where the binding constraint stopped being demand some time ago. The problem facing Chinese micro-drama studios in late 2026 is not whether anyone will watch. It is whether the unit economics survive a rules change that rewrote classification, labelling, platform duty and payment mechanics in a single quarter.
What actually changed on 1 September
The Measures are the first comprehensive rule for the format rather than a notice, and they do four things that matter operationally.
First, they define the object. A micro-drama is a serial work with episodes under twenty minutes, with a clear theme and main line, continuous and complete story, and defined characters. The definition reaches across every distribution channel: websites, apps and distribution platforms, broadcast channels and dedicated zones, internet television, IPTV and cable, received on televisions, phones, tablets, computers, public screens, wearables and in-vehicle devices. That breadth is deliberate. It closes the gap between "online content" and "television content" that the format had been exploiting since it began.
Second, they classify. Micro-dramas are divided into three categories by investment size and subject matter, with a filing and public-notice regime for some and a distribution licence regime for others.
Category
Basis
Regime
Practical effect
Class I
Higher investment, sensitive subject matter
Distribution licence or approval required before broadcast
Longest lead time, highest bar
Class II
Mid-range
Distribution licence or approval required before broadcast
Same gate, lighter dossier
Class III
Lower investment, general subject matter
Platform review, then title information filed with the regulator
Fastest path, platform bears first review
Third, they enumerate prohibited content across eleven items, including endangering national security, distorting national history, disparaging excellent traditional culture, and infringing the lawful rights of minors. Fourth, and this is the one that reshapes production decisions, they require any micro-drama generated or produced using artificial intelligence technology to carry a clear AI prompt mark in a prominent position in every episode.
The AI clause is the one with teeth
The labelling requirement did not arrive cold. It was built in three steps over eight months, and the sequencing tells you the regulator was reacting to a measurable shift in the production mix rather than anticipating one.
· From 1 April 2026, filing rules for AI comic-style dramas became fully mandatory.
· From 1 July 2026, the Administration issued a management notice setting out classification and layering standards for AI micro-dramas, requiring AI generation marks and setting requirements on content quality, subject selection and copyright protection.
· From 1 September 2026, the Measures made the per-episode AI mark a standing obligation across all distribution channels.
By 17 September 2026, at a State Council Information Office briefing, the Administration was describing the problem in unusually direct terms: AI dramas are developing very fast and account for a very high share, so the approach must encourage innovation while holding the bottom line, and in the end AI is a tool while people remain the subject of creation. The same briefing stated that live-action dramas are the main force of quality production and should be strongly supported. That is a policy signal about which category of producer the state intends to back, and studios reading it as incidental are misreading it.
There is a compliance mechanic underneath the principle. Machine review can identify explicit violations such as gore and violence. It cannot reliably identify distorted aesthetics, vulgarity, or content that violates public order and good morals. The industry response, pushed by the regulator, is that AI-simulated-human micro-dramas must have human review applied. That requirement converts a variable cost into a fixed one, and for the studios whose entire cost advantage was the absence of human review, it removes the advantage.
Every upload gets reviewed
The measures were followed by a further management notice from the Administration's network audiovisual department that tightened platform duty in ways that matter more to studios than the classification table does.
· Platforms must apply broadcast-then-review to nothing: user-uploaded micro-dramas are subject to strict "review everything that is broadcast" handling.
· Class I and Class II titles may only be broadcast after obtaining a Micro-Drama Distribution Licence or corresponding approval document.
· Class III titles are reviewed by the platform, which then files title information with the competent authority.
· Platforms may not distribute self-produced special-subject micro-dramas uploaded by individuals.
· Provincial authorities are to supervise and verify, and may explore broadcast-while-reviewing management within compliance.
The structural change is that the platform has become the regulatory counterparty of the studio. Every obligation above lands on a platform that now has a strong incentive to prefer producers who can produce clean paperwork on the first attempt. That is a quiet consolidation mechanism, and it will show up in commissioning behaviour before it shows up in any published market share data.
Alongside the review duty sit two obligations aimed squarely at the business model. Platforms must periodically evaluate their review algorithm mechanisms, increase recommendation weight for quality micro-dramas, and must not use algorithmic models that induce addiction or excessive consumption. And paid content must be provided under a lawfully concluded agreement with clearly published charging information protecting consumer rights.
The money problem, which predates the rules
Here is the part that the regulatory coverage tends to miss. The micro-drama business model had already broken before 1 September, and the rules are landing on an industry that was already repricing itself.
The mechanism was paid traffic acquisition. Studios bought traffic, tested a hook, and scaled whatever converted. In mid-2026 three things moved at once: model pricing rose, platform revenue-share terms adjusted, and regulation tightened. The distribution mechanism that had amplified marginal titles was withdrawn. Guangfa Securities' media and internet analyst described the outcome plainly: the flood-the-zone, bet-on-a-hitmodel of traffic buying returned to rationality, supply-side excess and homogenisation pushed down the win rate on traffic spend, and incremental viewing flattened. His framing is worth quoting because it is more precise than most: this is not a winter for content itself, it is the extinguishing of an upstream false fire that had been sustained by a single system's strong capital and channel distribution tilt.
The consequences for small and mid-sized studios are specific and financial rather than editorial.
· Cash flow is tight and collection periods are unstable, because platform settlement lags production spend.
· Traffic acquisition requires upfront capital, which makes the working capital gap structural rather than cyclical.
· Original subject matter requires long script development and higher shooting cost, and platform conversion rates are hard to predict in advance, which pushes companies away from innovation and toward homogeneous plots.
· Standardised formula micro-dramas trigger algorithmic recommendation more reliably, so investors prefer proven templates that minimise market testing risk.
That last point is the trap, and the rules have now closed part of it. A formula-driven, AI-generated title was the cheapest possible response to algorithmic incentives. It is now also the category carrying a mandatory per-episode AI mark, mandatory human review, and the lowest priority in the recommendation weighting the regulator has told platforms to apply.
The financing response is real but small
China's banks have started building products for the sector, which is a useful signal about both the size of the funding gap and its shape.
Lender
Product
Terms
Bank of Communications, Liaoning branch
First OPC plus micro-drama industry loan in the northeast
Proceeds tied to script acquisition, shooting, post-production and launch
ICBC, Xi'an Economic and Technological Development Zone sub-branch
RMB 3 million to a micro-drama producer
Account opening to disbursement in under five days
Qujiang Rural Commercial Bank
Micro-drama loan secured on copyright, shooting contracts and forecast revenue
Disbursement in three working days, rate about 20% below comparable products
Bank of Beijing
"Ten Billion New Vision" action plan, March 2026
RMB 10 billion of credit resources for the audiovisual sector
The pattern across all four is that lending is being secured on copyright, production contracts and forecast platform revenue shares rather than on fixed assets. That is the only way to lend to a business with no collateral, and it works only while platform revenue shares are predictable. The rules make them somewhat more predictable for compliant producers and considerably less so for everyone else.
Demand is not the problem
Every indicator on the consumption side is healthy, and this is worth stating because the regulatory coverage implies a contraction that the audience data does not show.
The 57th CNNIC report puts internet users at 1.125 billion with 80.1% penetration, online video users at 1.093 billion, short video at 1.074 billion, micro-drama at 664 million and livestreaming at 814 million. The National Bureau of Statistics put cultural and related industries value added at RMB 6.2094 trillion for 2024, 4.61% of GDP, up 0.02 percentage points, of which cultural services were RMB 4.3256 trillion, or 69.7%, cultural manufacturing RMB 1.2607 trillion, and cultural wholesale and retail RMB 623.1 billion. Note that the 2025 figure had not been published as of late October 2026, so 2024 remains the latest official year.
Where the pressure does show is in the adjacent revenue line. Kuaishou's second-quarter 2026 results showed total revenue of RMB 35.5 billion, up 1.4%, with online marketing services at RMB 20.6 billion, up 4.4%, other services at RMB 6.2 billion, up 18.5%, and livestreaming revenue at RMB 8.7 billion, down 13.5%. Average daily active users were 412.3 million and monthly active users 797.3 million. Livestreaming is the line that shares an audience and an attention pool with micro-drama, and it is the line that is falling.
Overseas is the release valve, and it is not a substitute
Chinese micro-dramas have become the fourth globally distributed audiovisual format after American film, Japanese animation and Korean television drama, according to the China-ASEAN Micro-Drama International Communication Development Report released by the Administration during the China-ASEAN Audiovisual Week in Beihai on 20 October 2026.
Market indicator
Figure
Cumulative downloads of Chinese micro-drama apps in ASEAN, to end-September 2026
1.217 billion
Cumulative in-app purchase revenue in ASEAN
US$438 million
Indonesia share of ASEAN downloads
56.77%
Indonesia downloads, first three quarters
411 million
Thailand
Highest ASEAN in-app revenue, only ASEAN market in global top ten
The mismatch between those two headline numbers is the point. 1.217 billion downloads produced US$438 million in cumulative in-app purchases, which works out to well under half a dollar of revenue per download. Downloads are where the audience is; revenue is not. Thailand is the instructive exception, being both the highest-revenue ASEAN market and the only one in the global top ten, which suggests that willingness to pay rather than willingness to install is the variable that matters.
There is also a reported conflict in the size of the Southeast Asian micro-drama market that deserves to be recorded rather than resolved: industry estimates place the sector at about US$510 million while official reporting puts in-app purchase revenue at about US$190 million for January to September. The gap is a definitional one between total industry value and platform-measured consumer spend, and no source reconciles the two.
Supply is still rising
Whatever the rules have done to economics, they have not yet reduced volume. The Administration's network audiovisual department publishes monthly filing notices for key micro-dramas, and the 2026 third-quarter series runs upward month by month:
Month, 2026
Key micro-drama filings
Leading subjects
July
143
Urban 44 (30.77%), legend 32 (22.38%), revolutionary 16 (11.19%)
August
207
Not itemised in the same notice
September
224
Urban 65 (29.02%), legend 58 (25.89%), revolutionary 22 (9.82%)
Subject categories expanded to sixteen types by September. On the production side, the China-ASEAN report records a cumulative domestic catalogue on the order of 490,000 titles and about 290,000 titles distributed overseas cumulatively, with new domestic production in the most recent reporting year recorded at roughly 33,000. Those three figures come from the same report and are not fully reconciled with each other, so they should be read as order-of-magnitude rather than as a consistent series.
The policy response runs alongside rather than against this. The Administration's quality micro-drama creation and communication implementation plan sets out a target of 1,000 outstanding micro-dramas per year and a support system substantially in place by the end of 2026, and the Measures explicitly encourage public participation in production, support outward-oriented co-production, relax restrictions on foreign creative participation, and promote simultaneous domestic and overseas release.
What a studio should actually do now
The compliance list is short; the strategic list is shorter. Ordered by what changes the outcome.
· Decide which class you are filing under before you shoot, not after. Investment size and subject matter set the category, and the category sets whether you need a distribution licence before broadcast. Retrofitting a Class III production into a Class II filing is the most expensive mistake available.
· Budget human review as a fixed cost. If the economics of a title depended on no human reviewing it, the title no longer has economics. AI-assisted production that retains human review is still cheaper than live action; AI-simulated-human production without review is not a product any more.
· Treat the audience data as the demand signal it is. 664 million viewers and a 59% penetration rate mean the constraint is conversion and retention, not reach. Spending to reach people who are already watching is the definition of the traffic-buying model that stopped working.
· Price the overseas market on revenue per download, not downloads. US$438 million against 1.217 billion installs is the real conversion rate, and any market entry plan built on install counts will misprice it.
· Read the platform's incentive correctly. Platforms now carry review duty, algorithm duty and disclosure duty, and will prefer producers whose paperwork is clean on the first pass. Being easy to clear is now a commercial asset.
The enforcement ladder
Chapter seven of the Measures sets out the disposal provisions, and they are worth knowing because they define the downside precisely rather than vaguely.
Violation
Available disposal
Launching a micro-drama without compliant review
Order to rectify, suspend updates, circulate a warning, fine up to RMB 100,000
Distributing prohibited or restricted content
Same ladder
Broadcasting a finished work that differs from the filed or licensed content
Same ladder
Transferring a filing application mid-review
Same ladder
Providing false filing materials
Same ladder, plus possible revocation of qualification where obtained by bribery or deception
Abuse of regulatory authority by personnel
Administrative sanction under law
The fine ceiling is modest in absolute terms. The real exposure is the suspension of updates and the circulation of a warning, because a suspended update schedule on a title in its monetisation window costs more than any fine, and a warning attaches to the platform's credit record rather than to the individual title.
The Measures also tighten the entry gate for platforms themselves. Every platform or channel carrying micro-dramas must hold the corresponding network audiovisual or radio and television business qualification, must implement a chief-editor content responsibility system with the chief editor's name filed to the regulator, and must establish a fully traceable review process. Platforms must re-review Class III titles that go back online, operate a credit grading system for key accounts, maintain an exit mechanism for violating entities, take down and delink violating titles immediately, and conduct standing inspections of content creators and promoters.
Three signals to watch before the year closes
The regime is three months old and its effect will show up in three places before anything else.
· The monthly filing notices. The July to September series of 143, 207 and 224 ran upward through the quarter. If the October and November prints flatten or fall while subject categories keep expanding, the supply correction is real. If they keep climbing, the rules have changed the cost structure without changing the volume.
· The split between live-action and AI output. The Administration has said live-action is the main force of quality production and should be supported, and AI titles carry a mandatory mark and mandatory human review. The share of AI-generated output, reported around 60%, is the number that will show whether that statement had budget behind it or was rhetoric.
· Platform commissioning terms. Because platforms now carry review, algorithm and disclosure duties, the producers who get commissioned will be the ones whose dossiers clear first pass. Watch which production companies appear repeatedly across platform slates in the fourth quarter.
None of these are published as statistics today, which is itself the finding. An industry with 664 million viewers and a national strategy behind it currently reports less about its own economics than the Saudi data center market does about its substations.
The provision the industry should be reading
The single most consequential line in the new regime is not the classification table and not the AI mark. It is the prohibition on algorithmic models that induce addiction or excessive consumption, combined with the obligation to publish charging information clearly. Between them, they remove the two mechanics that converted low-quality supply into revenue: the recommendation engine that surfaced it, and the payment flow that monetised impulse.
That is why the sector's reaction has been about capital rather than censorship. A business model that needed both mechanics is being asked to find another one, and the audience of 664 million has not gone anywhere.
Sources
· Five departments, Multi-Channel Distribution Service Management Regulation, effective 2026-09-01 — https://www.gov.cn/zhengce/2026-09-01/multi-channel-distribution-regulation.htm
· National Bureau of Statistics, 2024 cultural and related industries value added RMB 6.2094 trillion, 4.61% of GDP, 2025-12-30 — https://www.stats.gov.cn/sj/zxfb/202512/t20251230_1962179.html
· CNNIC, 57th Statistical Report on Internet Development, 2026-02-05 — http://www.cnnic.net.cn/NMediaFile/2026/0304/MAIN1772588317069TUXN3827X8.pdf
· Kuaishou Technology, Q2 2026 results, 2026-08-19 — https://ir.kuaishou.com/zh-hant/news-releases/news-release-details/kuaishoukejifabu2026niandierjidujizhongqiweijingshenhecaiwuyeji
· China Securities Journal, micro-drama sector reshuffle and regulatory signal, 2026-08-07 — https://www.cs.com.cn/qs/2026/08/07/detail_2026080710029900.html
· Guangdong Provincial Radio and Television Administration, interpretation of the new micro-drama rules — https://gbdsj.gd.gov.cn/zxzx/hydt/content/post_4959287.html
· Guangdong Provincial Radio and Television Administration, quality micro-drama creation plan, 2026-05-27 — https://gbdsj.gd.gov.cn/zxzx/hydt/content/post_4903094.html
This article was prepared by the expert team at Global Infinity, drawing on insights and data provided through its MCP data services.
About Global Infinity
Global Infinity is an AI innovation company specializing in MCP data services.
Email: support@globalinfinity.hk
For Media Inquiry
hk@asiapresswire.com
https://www.asiapresswire.com
Oct 26 · 03:00·ACN Newswire
Finance · SaaS
GitLab is not affected by CVE-2026-112900 or the other vulnerabilities fixed in Pillow 13.0.0. GitLab products do not include the Pillow library, and our Security team has found no evidence of impact to GitLab-managed infrastructure. GitLab.com, GitLab Self-Managed, and GitLab Dedicated are not impacted.
Pillow is one of the most widely used image libraries in the Python ecosystem. It often sits several layers down in a dependency tree, pulled in by a web framework, a thumbnailing service or an ML toolkit that nobody chose it for directly. On October 16, 2026, the Pillow project released version 13.0.0, and one of its security fixes is CVE-2026-112900: an argument injection in the way Pillow calls Ghostscript to render EPS images. The CVE record, published on October 19, rates it 9.2 (Critical) on CVSS 4.0. It affects every Pillow release from 2.6.0 up to, but not including, 13.0.0. No exploitation in the wild has been reported so far, but CISA's assessment marks it as automatable with total technical impact.
Upgrade Pillow to 13.0.0 on every project and image that handles untrusted images, and remove Ghostscript from images that do not need EPS support.
This guide is for security and platform teams with Python projects on GitLab. It covers the fixed version for each distribution, how the flaw works, the other High and Critical issues fixed in the same release, how to locate affected projects with dependency scanning, container scanning, GitLab Orbit, and code search, and how to remediate at scale with GitLab Duo Agent Platform.
CVE-2026-112900 at a glance
CVE-2026-112900 is an OS command and argument injection flaw in Pillow's EPS plugin, rated Critical (CVSS 4.0 score of 9.2) by the CVE Numbering Authority (CNA). The CVE record was published on October 19, 2026.
FieldDetail
CVECVE-2026-112900
GitHub advisoryGHSA-w889-685w-c8fh
TitlePillow: Argument Injection in Ghostscript call, potentially leading into RCE
WeaknessCWE-88 (argument injection), CWE-78 (OS command injection)
CVSS 4.09.2 Critical (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H)
Affected versionsPillow >= 2.6.0 and < 13.0.0
Fixed inPillow 13.0.0
Exploitation statusNone known at the time of writing (CISA SSVC assessment dated October 20, 2026)
Upgrade Pillow to a fixed version now
Upgrade Pillow to 13.0.0 or later. The CVE record lists 13.0.0 as the only fixed version, so every older branch needs to move to it. Framework updates and input validation on image contents do not help here, because the flaw is in how the filename reaches Ghostscript.
Your Python versionWhat to do
3.11 to 3.15Upgrade with pip install --upgrade "pillow>=13.0.0", or raise the pin in your lockfile or requirements file.
If your Pillow comes from a distribution package, check the distribution's tracker first. Distribution packages keep their own version numbers, so compare against the tracker instead of pip show. Status as of October 26, 2026:
DistributionPillow package versionStatus
Debian 12 (bookworm)9.4.0-1.1+deb12u1Vulnerable, no fix yet
Debian 13 (trixie)11.1.0-5+deb13u4Vulnerable, no fix yet
Debian forky (testing)12.3.0-1Vulnerable, no fix yet
Debian sid (unstable)13.0.0-1Fixed
SUSE Linux Enterprise (Server 15 SP4 to SP7 and 16.0 to 16.2, among others) and openSUSE Leap 16.0 and 16.1python-PillowAffected, no fix listed
Amazon Linux 2023 and 2027 Previewpython-pillowPending fix
Sources: Debian, SUSE and Amazon Linux security trackers, as of October 26, 2026. Amazon Linux 2 is listed as not affected. Ubuntu lists all releases as needing evaluation, and Red Hat, Arch Linux and Oracle Linux had no record for this CVE. Alpine's tracker could not be checked.
Until your distribution ships a fix, install Pillow 13.0.0 from PyPI in a virtual environment or container, or apply the workarounds below.
Rebuild your container images. If your Dockerfile installs Pillow without pinning a patch version, rebuild it with docker build --pull --no-cache and redeploy it so the install step resolves the fixed release. Images that pin a version, such as pillow==12.3.0, need the pin changed first. Images built on top of other base images only get the fix once their maintainers update them, so check the upstream image before you rebuild.
Pillow 13.0.0 also changes a few behaviors, such as how duplicate TIFF tags are handled and how I-mode images are saved as PNG, so run your image-processing tests before you ship the upgrade.
How the vulnerability works
EPS files are PostScript programs, so Pillow shells out to Ghostscript (gs) to render them, passing the input filename right after -f with no sanitizing.
When the image object has a .name that exists on disk, Pillow used that name as-is. Ghostscript's argument parser gives two kinds of strings special meaning:
A leading - is read as an option rather than a filename, which gives an attacker argument injection (CWE-88).
A leading @ tells Ghostscript to read more command-line arguments from the named text file. If the attacker also controls that file's contents, they control additional Ghostscript arguments, which is the path toward command execution (CWE-78).
The advisory notes that this works even with -dSAFER, the sandbox flag Pillow passes by default. That flag restricts what a PostScript program can do, but it does not stop an attacker from injecting arguments into the command line itself.
How to check if you are affected
You are exposed only if all of these are true:
Pillow is below 13.0.0.
Ghostscript is installed.
Your code opens an EPS file by a filename an attacker can influence, such as an upload saved under its original name.
The image is loaded or rendered, not just opened.
Full command execution also needs the attacker to control a text file referenced with a leading @. Services that generate their own filenames or use in-memory streams are far less likely to be reachable.
If you cannot upgrade yet: save uploads under generated names, restrict formats with Image.open(f, formats=["PNG", "JPEG"]), or remove Ghostscript from images that do not need it.
It's not just one bug: Every High and Critical issue in 13.0.0
The 13.0.0 release notes list 17 High and Critical advisories (3 Critical, 14 High). Fifteen of them map to a CVE. The two that do not, GHSA-xcvg-w56q-r89m and GHSA-78g4-xqwv-q3g8, are worth watching, because tools that match only on CVE IDs would miss them.
SeverityCVEGHSAIssue
CriticalCVE-2026-96639GHSA-v9pv-5gc8-w2m6Stale native image storage reused after mode transitions
CriticalCVE-2026-112398GHSA-5x8w-8jj5-q52hHeap buffer overflow in FlashPix (FPX) JPEG decoding
CriticalCVE-2026-112403GHSA-8g5g-8vmr-9782JPEG decoder heap buffer overflow from scanlines wider than tile extents
HighCVE-2026-96644GHSA-9v9v-9qvf-h2hjWMF/EMF heap out-of-bounds read from dimension truncation
HighCVE-2026-96637GHSA-g842-9rc4-69pwSPIDER decompression bomb bypass via seek()
HighCVE-2026-96643GHSA-g4qv-2jxx-769hUnbounded Exif header replacement loop
HighCVE-2026-96778GHSA-g7cr-3p24-7wf7JPEG comment write after ICC profile fills encoder buffer
HighCVE-2026-112395GHSA-462x-pgg6-55fpTIFF tile and YCbCr decoding out-of-bounds read from undersized libtiff buffers
HighCVE-2026-112404GHSA-c6hw-5grf-ff96TIFF tile and YCbCr decoding out-of-bounds read from undersized libtiff buffers
HighCVE-2026-112895GHSA-p4wg-p73j-c528PDF parsing stack exhaustion from long trailer chains and deep or cyclic page trees
HighCVE-2026-96640GHSA-mrfp-p49p-3hf2PDF append resource exhaustion from repeated page tree references
HighCVE-2026-112896GHSA-pchr-8j38-3x4pTIFF encoder accepted an incorrectly sized Colormap for non-8-bit images
HighCVE-2026-112393GHSA-332p-7hrc-92wfTIFF encoder heap buffer overflow when saving to a file object
HighNo CVE found yetGHSA-xcvg-w56q-r89mTIFF encoder heap buffer overflow when tags override the image size
HighCVE-2026-112902GHSA-xvh5-g6gv-559vTIFF encoder memory disclosure and crash from mismatched tag values
HighCVE-2026-112897GHSA-q45j-58j2-45rgTIFF decoding returned uninitialized memory for short JPEG strips
HighNo CVE (GitHub: "No known CVE")GHSA-78g4-xqwv-q3g8Bundled OpenJPEG heap buffer overflow when reading tile-part data
Locate Pillow across your GitLab groups
Find every project that installs Pillow, then fix first the ones that also have Ghostscript and accept uploads.
Dependency scanning reports the Pillow version in your lockfiles, including transitive dependencies. Turn it on per project, or for a whole group with a scan execution policy. Merge request approval policies can block merges that add a vulnerable version, and continuous vulnerability scanning re-checks existing projects when an advisory is published, for advisories up to 14 days old.
Container scanning finds Ghostscript installed as an OS package. Images with Pillow but no Ghostscript cannot render EPS files, so they are lower priority. It misses Ghostscript compiled from source. Turn container scanning on the same way.
GitLab Orbit: Because Pillow tends to arrive as someone else's dependency, asking "who uses it?" is hard from any single project. GitLab Orbit turns your projects, pipelines, security findings and code into a graph that an agent can query. Enable it on the top-level group, then ask for the Python projects that handle images and for the projects with open findings on CVE-2026-112900 or the other Pillow advisories. This will give you a shortlist before you open a single repository.
Orbit covers only the default branch and is in beta for Premium and Ultimate on GitLab.com and GitLab Self-Managed. It doesn't parse Dockerfiles yet, so confirm Ghostscript with the code search in the next step.
Code search finds what scanners miss. Run these in exact code search at the top-level group with regular expression mode on:
file:requirements.*\.txt$ (?i)^\s*pillow
lang:Dockerfile (?i)ghostscript
(?i)EpsImagePlugin|\.eps\b
Finally, compare the results with what actually runs. Anything running that your projects do not declare is a gap. For Kubernetes, operational container scanning covers the images in your clusters.
Remediate at scale with GitLab Duo Agent Platform
Once you have the list of affected projects, the remaining work is repetitive: raise a version, open a merge request, get it reviewed. Hand the repetitive part to agents and keep people on the decisions.
Start in Agentic Chat and ask it to list the Dependency Scanning findings for these Pillow CVEs from the Vulnerability Report (Ultimate), then create an epic with one issue per affected project. Assigning an issue to the Developer Flow produces a merge request that raises Pillow to 13.0.0 or later, or edits the version pinned in the Dockerfile. A flow trigger on the Assign event starts the flow as soon as the issue is assigned. The Code Review Flow can then give each merge request a first review against your review instructions.
The agents stop at the merge request. A person still has to review and merge each one, run the image-processing tests because 13.0.0 changes how duplicate TIFF tags and I-mode PNG saves behave, and confirm the fixed version is deployed before closing the issue.
Timeline
DateWhat happened
October 16Pillow releases 13.0.0 with fixes for 38 security entries. The release notes list the EPS Ghostscript issue as GHSA-w889-685w-c8fh with no CVE yet.
October 19GitHub, as CNA, reserves and publishes CVE-2026-112900 with a CVSS 4.0 score of 9.2 (Critical). CVE-2026-112393 and CVE-2026-112403, the TIFF writer and JPEG decoder heap overflows, are published the same day.
October 20CISA's coordinator adds an SSVC assessment for CVE-2026-112900: exploitation none, automatable yes, technical impact total.
October 23Debian lists only its unstable release (13.0.0-1) as fixed. Ubuntu lists all releases as needing evaluation.
Sources
Pillow 13.0.0 release notes
CVE-2026-112900 record and GHSA-w889-685w-c8fh
Fix commit a2c3631
Debian security tracker and Ubuntu security tracker, as of October 23, 2026
GitLab: Dependency scanning using SBOM
GitLab: Continuous dependency scanning
GitLab: Container scanning and exact code search
Oct 26 · 00:00·GitLab