Upgrade brotli to 1.2.1 #10337

Bundled Brotli in wheels is affected by CVE-2026-111497 (1.2.0 → 1.2.1)

What did you do?

Installed the latest Pillow wheel and checked the bundled libraries:

python3 -m pip install pillow
ls "$(python3 -c 'import PIL, os; print(os.path.dirname(PIL.__file__))')/../pillow.libs" | grep brotli

libbrotlicommon-53534446.so.1.2.0
libbrotlidec-7e5462ba.so.1.2.0

What did you expect to happen?

The wheel should bundle Brotli 1.2.1 or later. CVE-2026-111497 is an out-of-bounds write in the Brotli decoder. It affects 1.0.3 through 1.2.0 and is fixed in 1.2.1 (also in 1.1.1 and 1.0.10).

What actually happened?

The wheels bundle Brotli 1.2.0, which is in the affected range. FreeType links against it, so it's loaded whenever FreeType decodes Brotli-compressed font data (for example WOFF2).

Swapping in a 1.2.1 build of libbrotlicommon and libbrotlidec under the same file names works as a stopgap. Pillow's tests for FreeType text rendering and PNG save/load still pass after the swap. A wheel rebuilt against 1.2.1 would be the proper fix.

What are your OS, Python and Pillow versions?

• OS: Linux x86_64 (manylinux wheel)
• Python: 3.12
• Pillow: 13.0.0