Heap Buffer Overflow in Pillow via Compressed TIFF

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description

Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback sizes its allocation from the prior buffer size instead of the current write position, allowing an attacker-controlled out-of-line TIFF tag or retained ICC profile to be copied beyond the allocation after libtiff seeks forward. This overflow can crash the process and may allow code execution. Independently, unwritten alignment gaps in compressed TIFF output larger than 64 KiB can disclose stale heap bytes without a crafted tag. File paths and targets with real file descriptors are unaffected. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112393

Affected Vendors & Products

Vendor	Product	Version / Range
python-pillow	Pillow	>= 2.0.0, < 13.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

Pillow versions 2.0.0 to 13.0.0 have a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data to a target without a usable fileno(), such as BytesIO. The callback uses the prior buffer size instead of the current write position, allowing an attacker-controlled TIFF tag or ICC profile to be copied beyond the allocation after libtiff seeks forward. This can crash the process and may allow code execution. Unwritten alignment gaps in compressed TIFF output larger than 64 KiB can also disclose stale heap bytes.

Impact Analysis

This vulnerability can crash applications using affected Pillow versions when processing compressed TIFF files. In some cases, it may allow arbitrary code execution, potentially leading to data breaches or system compromise. Users of applications that handle TIFF images, especially in memory-constrained environments or when using BytesIO, are at risk.

Mitigation Strategies

Update Pillow to version 13.0.0 or later to address the heap buffer overflow and stale-heap disclosure issues in compressed TIFF data handling.

Hi! I’m here to help you understand CVE-2026-112393. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70