CVE-2026-112897

Received Received - Intake

Memory Disclosure in Pillow via TIFF Decoding

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description

Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the bytes written by libtiff, but Pillow converts the expected rows without clearing the unwritten tail. The tile path is affected from 5.3.0 and the strip path from 6.0.0. An attacker can supply a crafted TIFF to an application that loads and returns or re-encodes its pixels. This can disclose stale heap contents without memory corruption or a process crash. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112897

Affected Vendors & Products

Vendor	Product	Version / Range
python-pillow	Pillow	>= 5.3.0, < 13.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-908	The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

Executive Summary

Pillow, a Python imaging library, has a vulnerability where it can return uninitialized memory as pixels when libtiff decodes JPEG-compressed or Group 4 fax TIFF data. The issue occurs because buffers can be larger than the bytes written by libtiff, leaving unwritten memory exposed. This affects versions 5.3.0 to 13.0.0 and is fixed in 13.0.0.

Detection Guidance

This vulnerability involves uninitialized memory disclosure in Pillow when processing crafted TIFF files. Detection requires checking for applications using vulnerable Pillow versions (5.3.0 to 12.x) and scanning for suspicious TIFF file processing. No direct commands are provided in the context, but monitoring for crashes or memory leaks during TIFF processing may indicate exploitation.

Impact Analysis

An attacker could exploit this by providing a crafted TIFF file to an application using Pillow. This may lead to disclosure of stale heap contents, potentially exposing sensitive data without causing memory corruption or crashes.

Mitigation Strategies

Upgrade Pillow to version 13.0.0 or later immediately. If upgrading is not possible, restrict processing of TIFF files from untrusted sources or disable TIFF support entirely in applications using Pillow.

Hi! I’m here to help you understand CVE-2026-112897. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70