CVE-2026-112393

Undergoing Analysis Undergoing Analysis - In Progress

Heap Buffer Overflow in Pillow via Compressed TIFF

Publication date: 2026-10-19

Last updated on: 2026-10-26

Assigner: GitHub, Inc.

Description

Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback sizes its allocation from the prior buffer size instead of the current write position, allowing an attacker-controlled out-of-line TIFF tag or retained ICC profile to be copied beyond the allocation after libtiff seeks forward. This overflow can crash the process and may allow code execution. Independently, unwritten alignment gaps in compressed TIFF output larger than 64 KiB can disclose stale heap bytes without a crafted tag. File paths and targets with real file descriptors are unaffected. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-26

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-07

NVD

CVE-2026-112393

Affected Vendors & Products

Vendor	Product	Version / Range
python	pillow	From 2.0.0 (inc) to 13.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

Pillow versions 2.0.0 to 13.0.0 have a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data to a target without a usable fileno(), such as BytesIO. The callback uses the prior buffer size instead of the current write position, allowing an attacker-controlled TIFF tag or ICC profile to be copied beyond the allocation after libtiff seeks forward. This can crash the process and may allow code execution. Unwritten alignment gaps in compressed TIFF output larger than 64 KiB can also disclose stale heap bytes.

Detection Guidance

This vulnerability affects Pillow versions 2.0.0 to 13.0.0 when saving compressed TIFF data to targets without a usable fileno(), such as BytesIO. Detection involves checking installed Pillow versions and inspecting TIFF file handling code. No specific commands are provided in the context to directly detect exploitation.

Impact Analysis

This vulnerability can crash applications using affected Pillow versions when processing compressed TIFF files. In some cases, it may allow arbitrary code execution, potentially leading to data breaches or system compromise. Users of applications that handle TIFF images, especially in memory-constrained environments or when using BytesIO, are at risk.

Compliance Impact

The vulnerability in Pillow could potentially lead to unauthorized code execution or data disclosure if exploited, which may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security). Unauthorized access to sensitive data could result in breaches of confidentiality and integrity.

Mitigation Strategies

Update Pillow to version 13.0.0 or later to address the heap buffer overflow and stale-heap disclosure issues in compressed TIFF data handling.

Hi! I’m here to help you understand CVE-2026-112393. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...