Pillow can return uninitialized memory as pixels during TiffDecode of short JPEG-compressed or Group 4 fax strips, allowing a crafted TIFF file to expose stale heap contents. This flaw does not corrupt memory or crash the process; instead it leaks data that was previously stored on the heap, which can reveal sensitive information. The weakness is classified as CWE-908.

The Pillow imaging library from version 5.3.0 through 13.0.0 is affected. The tile decoding path shipped from 5.3.0 and the strip decoding path from 6.0.0 are vulnerable. The issue was resolved in Pillow 13.0.0, so any release prior to that is potentially at risk.

The CVSS score of 8.7 indicates high severity, and the EPSS score is not available, so the exploitation likelihood cannot be precisely measured. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the flaw by delivering a malicious TIFF to an application that loads or re-encodes the image, enabling disclosure of stale heap data. The attack requires no privileged access and can occur in any process that imports Pillow for image handling.