Description
Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-copy loop walks beyond that allocation. An attacker can supply a crafted tiled TIFF to an application that loads it. This can expose adjacent heap data in pixels or crash the process. This issue is fixed in version 13.0.0.
Published: 2026-10-19
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: Heap memory corruption allowing data exposure or crash
Action: Patch
AI Analysis

Impact

The Pillow tiled‑TIFF decoder copies four‑byte pixels without checking that the tile buffer is large enough. When libtiff allocates a smaller buffer, the stride‑and‑copy loop walks past the end of the allocation, causing an out‑of‑bounds read. The read can leak adjacent heap data or trigger a crash, compromising confidentiality or availability.

Affected Systems

The vulnerability affects the Pillow imaging library distributed as the python‑pillow package. Libraries numbered 8.2.0 through 12.9.x are vulnerable; the bug is fixed in Pillow 13.0.0 and later.

Risk and Exploitability

Severity is moderate with a CVSS score of 6.5. Exploitation likelihood is not quantified in EPSS, and the issue is not listed in CISA KEV. An attacker can supply a crafted TIFF to a program that loads images, enabling remote or local exploitation depending on how the application receives image data. The impact is data exposure or process crash if the vulnerability is leveraged.

Generated by OpenCVE AI on October 20, 2026 at 00:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Pillow to version 13.0.0 or later to apply the fix.
  • Ensure that the application does not load TIFF files from untrusted sources, or validate incoming images before processing.
  • If immediate upgrade is not possible, isolate image processing in a sandboxed environment and monitor for unexpected crashes.

Generated by OpenCVE AI on October 20, 2026 at 00:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 19 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Python-pillow
Python-pillow pillow
Vendors & Products Python-pillow
Python-pillow pillow

Mon, 19 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
Description Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-copy loop walks beyond that allocation. An attacker can supply a crafted tiled TIFF to an application that loads it. This can expose adjacent heap data in pixels or crash the process. This issue is fixed in version 13.0.0.
Title Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
Weaknesses CWE-122
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'}

Subscriptions

Python-pillow Pillow
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-19T20:59:15.098Z

Reserved: 2026-10-19T16:58:51.959Z

Link: CVE-2026-112395

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T21:17:07.880

Modified: 2026-10-19T21:17:07.880

Link: CVE-2026-112395

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-19T20:59:15Z

Links: CVE-2026-112395 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T00:30:07Z

Weaknesses