Heap Buffer Overflow in Pillow Python Imaging Library

CVE-2026-112393

What is CVE-2026-112393?

Pillow, the widely used Python imaging library, has a vulnerability resulting from a heap buffer overflow and stale-heap disclosure in its TIFF data handling. In versions ranging from 2.0.0 to 13.0.0, the library utilizes outdated buffer sizes during the writing of compressed TIFF files via libtiff to targets such as BytesIO, which lack a usable file descriptor. This flaw permits the potential execution of attacker-controlled data owing to out-of-line TIFF tags or retained ICC profiles being improperly copied beyond allocated buffers. Furthermore, for TIFF outputs with alignment gaps exceeding 64 KiB, it may inadvertently expose stale heap data. It's crucial to update to version 13.0.0 or later to mitigate these risks.

References