Pillow: Out-of-bounds read in TIFF encoder via crafted ColorMap metadata
Summary
Pillow, a Python imaging library, does not check that a retained TIFF ColorMap matches the sample depth (BitsPerSample) when an image is saved as TIFF through the libtiff-based encoder. An attacker can supply a small crafted TIFF that is opened and loaded normally, but the out-of-bounds read occurs when the application re-encodes the image with retained metadata. The result can be disclosure of heap memory in the output or a process crash. The vulnerability requires an application that processes attacker-supplied TIFFs and saves them again with metadata retained.
Affected
- Pillow up to and including 12.3.0 (advisory: affected versions <= 12.3.0; CVE record: < 13.0.0)
Fixed in
- Pillow 13.0.0
Workaround
- Unknown. No vendor-documented workaround exists beyond upgrading. Removing one of the trigger conditions in application code (not re-saving untrusted TIFFs with retained metadata) would reduce exposure, but this is not a vendor-endorsed mitigation.
Exploitation
- CISA SSVC: exploitation status poc, automatable yes, technical impact partial.
- The GHSA advisory publishes a reproducer, so a public proof of concept should be assumed.
- Not listed in CISA KEV. No confirmed in-the-wild exploitation known.
- Impact per sources: heap memory disclosure or crash; remote code execution is not claimed.
Our recommendation
- Inventory all Python applications and container images for Pillow, including transitive dependencies.
- Upgrade to Pillow 13.0.0 or later and check that version pins or caps do not keep systems on 12.3.x.
- Prioritise internet-facing applications that accept user-supplied TIFF files and re-save them.
- Verify that container base images and vendor appliances have been rebuilt with the fixed version.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-pchr-8j38-3x4p github.com
- Pillow 13.0.0 release github.com
- Fix commit d03dc3c5 github.com
- OSV GHSA-pchr-8j38-3x4p osv.dev
- OpenCVE CVE-2026-112896 app.opencve.io
- Ubuntu CVE-2026-112896 ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:43.
Original description (NVD)
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read. This can disclose heap memory in the output or crash the process. This issue is fixed in version 13.0.0.
NVD references (4)
- https://github.com/python-pillow/Pillow/commit/d03dc3c587a9b0bdc9e4304d70d59a635a87b742
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-pchr-8j38-3x4p
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-pchr-8j38-3x4p
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.