Description
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read. This can disclose heap memory in the output or crash the process. This issue is fixed in version 13.0.0.
Published: 2026-10-19
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch Immediately
AI Analysis

Impact

The CVE describes an out-of-bounds read in Pillow’s TIFF encoder caused by a ColorMap plane-size inconsistency with BitsPerSample. When a small TIFF is opened, Pillow retains a crafted ColorMap that is later reused during re-encoding. An attacker can trigger the buffer read, causing heap memory to be exposed in the output or the process to terminate. The weakness is a memory read vulnerability and is classified as CWE‑125.

Affected Systems

The vulnerability affects the Python Pillow imaging library. Any Pillow installation prior to version 13.0.0 is vulnerable. The issue was resolved in release 13.0.0, so any deployment still using Pillow 12.x or earlier must upgrade. No other products or vendors are listed.

Risk and Exploitability

The CVSS score of 8.8 indicates a high‑impact flaw. EPSS is not available, and the item is not listed in the CISA KEV catalog. The exploit requires an application to open and re‑encode a TIFF image that contains a malicious ColorMap. A remote attacker who can supply images to such an application can trigger the out‑of‑bounds read, potentially leaking sensitive heap data or causing a denial of service. The attack vector is likely remote via crafted image input delivered to a vulnerable service.

Generated by OpenCVE AI on October 20, 2026 at 06:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Pillow to version 13.0.0 or later to apply the hardening change that fixes the mismatched ColorMap plane-size handling.
  • Ensure that all runtime environments, virtual environments, or containers use the updated Pillow library and that older versions cannot be imported inadvertently.
  • If an immediate upgrade cannot be performed, remove or sandbox the processing of TIFF files from untrusted sources, and consider rejecting such uploads entirely to prevent exploitation.

Generated by OpenCVE AI on October 20, 2026 at 06:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-pchr-8j38-3x4p Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
History

Tue, 27 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Python
Python pillow
CPEs cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
Vendors & Products Python
Python pillow
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'}

 cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'}

Tue, 20 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'}

threat_severity

Important

Tue, 20 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Python-pillow
Python-pillow pillow
Vendors & Products Python-pillow
Python-pillow pillow

Mon, 19 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
Description Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read. This can disclose heap memory in the output or crash the process. This issue is fixed in version 13.0.0.
Title Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
Weaknesses CWE-125
References
Metrics cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Python Pillow
Python-pillow Pillow
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-20T13:55:36.949Z

Reserved: 2026-10-19T20:16:09.856Z

Link: CVE-2026-112896

cve-icon Vulnrichment

Updated: 2026-10-20T13:55:28.384Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-19T22:17:09.760

Modified: 2026-10-27T14:55:49.017

Link: CVE-2026-112896

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-19T21:59:17Z

Links: CVE-2026-112896 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T07:00:13Z

Weaknesses