Pillow: Information disclosure of uninitialized memory in TIFF decoding
Summary
Pillow, a Python imaging library, returns uninitialized heap memory as image pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF files. An attacker can supply a crafted TIFF to an application that loads the image and returns or re-encodes its pixels, such as a thumbnail, preview or converted copy. This can disclose stale heap contents from the worker process without memory corruption or a crash.
Affected
- Pillow versions 5.3.0 up to and including 12.3.0 (CNA range: >= 5.3.0, < 13.0.0)
- Tile path affected since 5.3.0, strip path since 6.0.0
Fixed in
- Pillow 13.0.0
Workaround
- No workaround is listed in the CVE record.
- Interim measure (not from a vendor source): do not accept TIFF uploads, or convert them to another format in an isolated worker before processing.
Exploitation
- No in-the-wild exploitation known. CISA SSVC: exploitation status poc, not automatable.
- The advisory includes a reproduction method, so the technique is publicly known.
- Not listed in CISA KEV.
Our recommendation
- Inventory Pillow versions, including transitive dependencies in containers and virtualenvs.
- Upgrade Pillow to 13.0.0 or later, prioritising internet-facing services that handle uploads.
- Until patched, block or sandbox TIFF inputs in upload paths.
- Check whether any application opens uploaded TIFFs with Pillow and returns pixel-derived output.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-q45j-58j2-45rg github.com
- Pillow 13.0.0 release github.com
- Fix commit 1d4773e6 github.com
- Pillow 13.0.0 release notes pillow.readthedocs.io
- OSV GHSA-q45j-58j2-45rg osv.dev
- VulDB entry 422555 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:52.
Original description (NVD)
Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the bytes written by libtiff, but Pillow converts the expected rows without clearing the unwritten tail. The tile path is affected from 5.3.0 and the strip path from 6.0.0. An attacker can supply a crafted TIFF to an application that loads and returns or re-encodes its pixels. This can disclose stale heap contents without memory corruption or a process crash. This issue is fixed in version 13.0.0.
NVD references (4)
- https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-q45j-58j2-45rg
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-q45j-58j2-45rg
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.