CVE-2026-112896

Received Received - Intake

Buffer Overflow in Pillow TIFF Encoder

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read. This can disclose heap memory in the output or crash the process. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112896

Affected Vendors & Products

Vendor	Product	Version / Range
python-pillow	Pillow	< 13.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

Pillow is a Python imaging library. Prior to version 13.0.0, its TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A crafted TIFF can be opened normally and then retain a ColorMap that is reused when the image is saved. Re-encoding the image with libtiff can trigger an out-of-bounds read, potentially disclosing heap memory or crashing the process.

Detection Guidance

Detecting this vulnerability requires checking the installed version of Pillow. Run 'pip show Pillow' or 'python -c "import PIL; print(PIL.__version__)"' to verify if the version is below 13.0.0. If so, the system is vulnerable.

Impact Analysis

This vulnerability can lead to information disclosure by exposing heap memory in the output or cause the application to crash. If exploited, it may allow attackers to access sensitive data or disrupt services relying on Pillow for image processing.

Mitigation Strategies

Upgrade Pillow to version 13.0.0 or later immediately. Use 'pip install --upgrade Pillow' or your package manager to update. Avoid processing untrusted TIFF files until the update is applied.

Hi! I’m here to help you understand CVE-2026-112896. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70