CVE-2026-128067
Awaiting Analysis Awaiting Analysis - Queue

Heap Buffer Overflow in Pillow via TIFF Image Processing

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
Pillow is a Python imaging library. From 2.3.0 through 12.3.0, Pillow applications that save compressed TIFF images through libtiff can pass attacker-controlled image geometry tags to the encoder while allocating its row buffer from the actual image dimensions. The affected TiffImagePlugin._save path allows ImageWidth, ImageLength, or SamplesPerPixel from exif=, tiffinfo=, or a source TIFF IFD to make libtiff consume a larger scanline than the buffer supplied by ImagingLibTiffEncode. This can read heap memory into the generated TIFF or crash the process. When TIFF Predictor 2 is enabled, libtiff can rewrite the oversized scanline in place and corrupt memory beyond the buffer. A carried-over PlanarConfiguration value of 2 instead makes libtiff use a shorter scanline and can produce an undecodable output file, but is not established to cause the out-of-bounds access. This issue is fixed in version 13.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128067

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
python pillow From 2.3.0 (inc) to 12.3.0 (inc)
python pillow 13.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Pillow library involves a buffer overflow issue when saving compressed TIFF images using libtiff. Attackers can manipulate TIFF metadata tags like ImageWidth, ImageLength, or SamplesPerPixel to override actual image dimensions. This causes libtiff to process scanlines larger than the allocated buffer, leading to heap memory exposure, crashes, or memory corruption. The issue arises because Pillow allows external tag overrides during encoding, which libtiff then uses to calculate scanline sizes.

The vulnerability affects versions 2.3.0 through 12.3.0 and is fixed in version 13.0.0. It specifically impacts applications that save TIFF files with compression enabled and either preserve metadata or process crafted palette TIFFs.

Detection Guidance

Check Pillow version with pip show pillow. If version is below 13.0.0, the system is vulnerable. Inspect TIFF files processed by Pillow for unusual metadata tags like ImageWidth, ImageLength, or SamplesPerPixel that may override actual image dimensions.

Impact Analysis

If you use Pillow to save compressed TIFF images with libtiff, an attacker could exploit this to read sensitive memory or crash your application. Malicious metadata in TIFF files could cause libtiff to read or write beyond allocated buffers, exposing heap data or corrupting memory. This is especially risky for applications handling user-uploaded images or preserving metadata during conversions.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing sensitive data or causing system instability. A heap buffer overflow in TIFF image processing may lead to unauthorized memory access, which could result in data leaks or corruption. Such incidents may violate data protection requirements under GDPR (e.g., integrity and confidentiality principles) and HIPAA (e.g., safeguarding protected health information).

Mitigation Strategies

Upgrade Pillow to version 13.0.0 or later. Avoid using libtiff for TIFF compression in Pillow. If libtiff must be used, disable metadata preservation during image processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128067. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...