Pillow: Out-of-bounds read in TIFF tile and RGBA decode paths
Summary
Pillow, a Python imaging library, reads beyond the end of a heap buffer when decoding crafted TIFF files with duplicated PhotometricInterpretation or BitsPerSample tags. An attacker who can get an application to load such an image can obtain fragments of heap memory in the returned pixels, or crash the process. The attack requires that the application opens attacker-supplied TIFF files with Pillow, for example through upload or thumbnail features.
Affected
- Pillow 8.1.0 up to and including 12.3.0 (affected range: >= 8.1.0, < 13.0.0)
Fixed in
- Pillow 13.0.0 (fix commit 1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce)
- No fixed 12.x release is known.
- Pillow 13 requires Python 3.11 or newer.
Workaround
- No vendor workaround is known. The fix is to upgrade.
- If upgrading is not possible, validate incoming TIFF files strictly before they reach Pillow, or reject TIFF uploads if the application does not need them.
Exploitation
- CISA SSVC: exploitation status poc, automatable yes, technical impact partial.
- VulDB reports no exploit available. No in-the-wild exploitation was found.
- A public proof-of-concept reproducer is referenced in the advisory.
Our recommendation
- Check whether any application uses Pillow to open TIFF files from untrusted sources, including indirect dependencies.
- Upgrade Pillow to 13.0.0 or later, and make sure the Python version is 3.11 or newer.
- If the upload endpoint is public, prioritise the upgrade.
- Run TIFF decoding in an isolated container with minimal secrets and data.
- Monitor for unusual upload activity and failed image loads.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-c6hw-5grf-ff96 github.com
- Fix commit 1d4773e6 github.com
- Pillow 13.0.0 release github.com
- OSV BIT-pillow-2026-112404 osv.dev
- GitLab advisory CVE-2026-112404 advisories.gitlab.com
- VulDB CVE-2026-112404 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:44.
Original description (NVD)
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not verify that the required input row fits inside the row libtiff produced, while the strip path has this validation. Loading pixels from such a crafted TIFF can expose adjacent heap data in output pixels or crash the process. This issue is fixed in version 13.0.0.
NVD references (4)
- https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-c6hw-5grf-ff96
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-c6hw-5grf-ff96
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.