CVE-2026-112404

Modified Modified - Updated After Analysis

Out-of-Bounds Read in Pillow TIFF Processing

Publication date: 2026-10-19

Last updated on: 2026-10-28

Assigner: GitHub, Inc.

Description

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not verify that the required input row fits inside the row libtiff produced, while the strip path has this validation. Loading pixels from such a crafted TIFF can expose adjacent heap data in output pixels or crash the process. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-28

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-07

NVD

CVE-2026-112404

Affected Vendors & Products

Vendor	Product	Version / Range
python	pillow	From 8.1.0 (inc) to 13.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-126	The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Attack-Flow Graph

Executive Summary

This vulnerability affects Pillow, a Python imaging library. Between versions 8.1.0 and 13.0.0, improper handling of TIFF image data can cause Pillow to read beyond the intended row data produced by libtiff. This happens when Pillow and libtiff interpret certain image tags differently, leading to potential exposure of adjacent heap data or crashes.

Detection Guidance

To detect this vulnerability, check if your system uses Pillow versions between 8.1.0 and 13.0.0. Run 'pip show Pillow' or 'pip list | grep Pillow' to verify the installed version. If the version is within the vulnerable range, update to version 13.0.0 or later immediately.

Impact Analysis

If exploited, this flaw could allow attackers to read sensitive memory data or crash applications using Pillow. This may lead to information disclosure or denial-of-service conditions in systems processing malicious TIFF images.

Compliance Impact

This vulnerability could potentially expose sensitive data in memory adjacent to processed image pixels, which may violate data protection requirements under GDPR or HIPAA if such images contain personal or health information. The crash risk may also disrupt compliance with availability requirements.

Mitigation Strategies

Upgrade Pillow to version 13.0.0 or later to address the vulnerability. Avoid processing untrusted TIFF files until the update is applied.

Hi! I’m here to help you understand CVE-2026-112404. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...