The Pillow tiled‑TIFF decoder copies four‑byte pixels without checking that the tile buffer is large enough. When libtiff allocates a smaller buffer, the stride‑and‑copy loop walks past the end of the allocation, causing an out‑of‑bounds read. The read can leak adjacent heap data or trigger a crash, compromising confidentiality or availability.

The vulnerability affects the Pillow imaging library distributed as the python‑pillow package. Libraries numbered 8.2.0 through 12.9.x are vulnerable; the bug is fixed in Pillow 13.0.0 and later.

Severity is moderate with a CVSS score of 6.5. Exploitation likelihood is not quantified in EPSS, and the issue is not listed in CISA KEV. The CVE states that an attacker can supply a crafted TIFF to an application that loads it, which can lead to data exposure or a crash. The likely attack vector is the image loading process; however, the data does not explicitly state whether exploitation would occur remotely or locally, so that is inferred based on the context.