Out-of-Bounds Read in Pillow TIFF Processing

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not verify that the required input row fits inside the row libtiff produced, while the strip path has this validation. Loading pixels from such a crafted TIFF can expose adjacent heap data in output pixels or crash the process. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112404

Affected Vendors & Products

Vendor	Product	Version / Range
python-pillow	Pillow	>= 8.1.0, < 13.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-126	The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Attack-Flow Graph

Executive Summary

This vulnerability affects Pillow, a Python imaging library. Between versions 8.1.0 and 13.0.0, improper handling of TIFF image data can cause Pillow to read beyond the intended row data produced by libtiff. This happens when Pillow and libtiff interpret certain image tags differently, leading to potential exposure of adjacent heap data or crashes.

Impact Analysis

If exploited, this flaw could allow attackers to read sensitive memory data or crash applications using Pillow. This may lead to information disclosure or denial-of-service conditions in systems processing malicious TIFF images.

Mitigation Strategies

Upgrade Pillow to version 13.0.0 or later to address the vulnerability. Avoid processing untrusted TIFF files until the update is applied.

Hi! I’m here to help you understand CVE-2026-112404. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70