Heap Use-After-Free Vulnerability in Pillow Imaging Library

CVE-2026-112396

What is CVE-2026-112396?

The Pillow imaging library, versions 11.3.0 through 13.0.0, contains a heap use-after-free vulnerability that occurs during the encoding of TIFF data to an in-memory buffer. When libtiff encounters a rejected tag while processing, it leads to a situation where the output buffer is freed without properly handling the TIFF handle, allowing later operations to access freed memory. This can result in process crashes and potentially opens a pathway for code execution, putting applications at risk. Users are advised to upgrade to version 13.0.0 or later to mitigate this vulnerability.

References