Buffer Overread Vulnerability in Pillow Python Imaging Library
CVE-2026-112395

6.5MEDIUM

Key Information:

Vendor

Python-pillow

Status
Pillow
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112395?

The Pillow Python imaging library displays a buffer overread vulnerability in its tiled-TIFF decoder. Versions from 8.2.0 to 13.0.0 are affected, where an attacker can exploit this by supplying a crafted tiled TIFF file. This manipulation can lead to adjacent heap data exposure or application crashes due to reading beyond allocated memory. The flaw arises when libtiff returns a tile allocation smaller than required, resulting in potential security risks. This issue has been addressed in version 13.0.0 of Pillow.

Affected Version(s)

Pillow >= 8.2.0, < 13.0.0

References

https://github.com/python-pillow/Pillow/security/advisori...
x_refsource_CONFIRM
https://github.com/python-pillow/Pillow/commit/76869efdbb...
x_refsource_MISC
https://github.com/python-pillow/Pillow/releases/tag/13.0.0
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.