CVE-2026-128066
Awaiting Analysis Awaiting Analysis - Queue

Memory Exhaustion in Pillow via Malicious TIFF or EXIF Data

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
Pillow is a Python imaging library. From 1.0 through 12.3.0, ImageFileDirectory_v2.load() in src/PIL/TiffImagePlugin.py retains a separate bytes object for each out-of-line IFD tag value without limiting the total data read or preventing distinct tags from referencing the same file region. A small crafted TIFF or EXIF-bearing JPEG, PNG, WebP, or MPO can therefore cause memory use quadratic in the input size. TIFF and some JPEG paths trigger parsing during Image.open(), while other formats are exposed when EXIF is requested, including through getexif() or ImageOps.exif_transpose(). The declared pixel dimensions do not bound this metadata allocation, so decompression-bomb checks do not prevent process memory exhaustion. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128066

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
python pillow From 1.0 (inc) to 12.3.0 (inc)
python pillow 13.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Pillow (Python imaging library) allows an attacker to craft a small TIFF or EXIF-bearing image file that causes memory usage to grow quadratically with the input size. The flaw occurs in ImageFileDirectory_v2.load() which retains separate bytes objects for each out-of-line IFD tag value without limiting total data read. This can lead to memory exhaustion as distinct tags reference the same file region.

Detection Guidance

Monitor for unusually high memory usage when processing TIFF, JPEG, PNG, WebP, or MPO files. Check for crashes during image parsing or EXIF extraction. Use tools like `top` or `htop` to observe memory consumption spikes when handling image files.

Impact Analysis

This vulnerability can cause denial-of-service by exhausting system memory when processing crafted images. It may crash applications or stall processes handling uploaded images, especially those using TIFF, JPEG, PNG, WebP, or MPO formats with EXIF data. Memory usage can become thousands of times larger than the original file size.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks through memory exhaustion. If exploited, it may cause system crashes or slowdowns during image processing, potentially disrupting services handling sensitive data. GDPR requires data protection measures to ensure availability, while HIPAA mandates safeguards against disruptions that could compromise protected health information.

Mitigation Strategies

Upgrade Pillow to version 13.0.0 or later. Avoid processing untrusted image files, especially TIFF and those with EXIF metadata. Implement size limits for uploaded images and validate file formats strictly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128066. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...