Pillow ImagingJpegDecode heap buffer overflow via SOF3 lossless JPEG draft scaling mismatch

#!/usr/bin/env python3
"""check_cve_2026_112403.py — Detect CVE-2026-112403 (Pillow heap overflow in ImagingJpegDecode)
Outputs: VULNERABLE / PATCHED / UNKNOWN
Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
"""
import sys

def main():
    try:
        from PIL import Image
        import PIL
    except ImportError:
        print("UNKNOWN — Pillow is not installed in this environment.")
        sys.exit(2)

    pillow_version = getattr(PIL, '__version__', '0.0.0')
    print(f"[*] Pillow version: {pillow_version}")

    # Parse version tuple
    try:
        parts = pillow_version.split('.')
        ver_tuple = tuple(int(x.split('dev')[0].split('a')[0].split('b')[0].split('rc')[0]) for x in parts[:3])
    except (ValueError, IndexError):
        print(f"UNKNOWN — Could not parse Pillow version '{pillow_version}'.")
        sys.exit(2)

    # Check if Pillow >= 13.0.0 (patched)
    if ver_tuple >= (13, 0, 0):
        print(f"PATCHED — Pillow {pillow_version} >= 13.0.0. CVE-2026-112403 is fixed.")
        sys.exit(0)

    # Pillow < 13.0.0 — check libjpeg-turbo version
    print(f"[*] Pillow {pillow_version} < 13.0.0 — checking libjpeg-turbo linkage...")

    ljt_version = None
    try:
        # Pillow exposes jpeg library info via features
        from PIL import features
        jpeg_info = features.version('libjpeg')
        if jpeg_info:
            print(f"[*] libjpeg version string: {jpeg_info}")
            # libjpeg-turbo reports versions like '3.0.0', IJG reports like '9e'
            try:
                ljt_parts = jpeg_info.split('.')
                if len(ljt_parts) >= 2:
                    ljt_major = int(ljt_parts[0])
                    ljt_version = ljt_major
            except ValueError:
                pass
    except Exception:
        pass

    # Also check via pillow_info for turbo indicator
    is_turbo = False
    try:
        from PIL import features
        is_turbo = bool(features.check('libjpeg_turbo'))
        if is_turbo:
            print("[*] libjpeg-turbo detected (turbo=True).")
        else:
            print("[*] libjpeg-turbo NOT detected (using IJG libjpeg or unknown).")
    except Exception:
        pass

    if ver_tuple < (13, 0, 0):
        if is_turbo and ljt_version is not None and ljt_version >= 3:
            print(f"VULNERABLE — Pillow {pillow_version} with libjpeg-turbo {ljt_version}.x.")
            print("  CVE-2026-112403: Heap buffer overflow in ImagingJpegDecode")
            print("  with SOF3 lossless JPEG when thumbnail()/draft() is used.")
            print("  Remediation: pip install --upgrade 'Pillow>=13.0.0'")
            sys.exit(1)
        elif is_turbo and (ljt_version is None or ljt_version < 3):
            print(f"PATCHED — Pillow {pillow_version} links libjpeg-turbo < 3.0.")
            print("  libjpeg-turbo 2.x rejects SOF3 input; not exploitable.")
            print("  Note: Upgrade Pillow to >= 13.0.0 anyway for 43 other fixes.")
            sys.exit(0)
        elif not is_turbo:
            print(f"PATCHED — Pillow {pillow_version} uses IJG libjpeg (not turbo).")
            print("  IJG libjpeg does not decode SOF3; not exploitable.")
            print("  Note: Upgrade Pillow to >= 13.0.0 anyway for 43 other fixes.")
            sys.exit(0)
        else:
            print(f"UNKNOWN — Pillow {pillow_version} < 13.0.0 but could not")
            print("  determine libjpeg-turbo version. Assume VULNERABLE and upgrade.")
            sys.exit(2)

if __name__ == '__main__':
    main()