CVE-2026-112395

HighCVSS 8.2/10Last modified Oct 28, 2026

Description

Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-copy loop walks beyond that allocation. An attacker can supply a crafted tiled TIFF to an application that loads it. This can expose adjacent heap data in pixels or crash the process. This issue is fixed in version 13.0.0.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-122

Affected software

Vendor	Product	Versions
python-pillow	Pillow	>= 8.2.0, < 13.0.0

References

https://github.com/python-pillow/Pillow/commit/76869efdbbf2ad7dccd7536520fb61b7a00ab61ePatch
https://github.com/python-pillow/Pillow/releases/tag/13.0.0Release Notes
https://github.com/python-pillow/Pillow/security/advisories/GHSA-462x-pgg6-55fpExploit, Vendor Advisory
https://github.com/python-pillow/Pillow/security/advisories/GHSA-462x-pgg6-55fpExploit, Vendor Advisory

Timeline

Published: Oct 19, 2026
Last modified: Oct 28, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-1123967.5Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIF CVE-2026-1123977.5Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-wi CVE-2026-1123989.8Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated ti CVE-2026-1123997.5Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before CVE-2026-11249.8A security flaw has been discovered in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/wo CVE-2026-112403.1Insufficient validation of untrusted input in Loader in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised t CVE-2026-1124007.5Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exceptio CVE-2026-1124017.5Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile._see CVE-2026-1124027.5Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allo CVE-2026-1124039.8Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a request CVE-2026-1124048.2Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by l CVE-2026-1124057.5Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips t