Memory Disclosure Vulnerability in Pillow Imaging Library by Python

CVE-2026-112897

What is CVE-2026-112897?

Pillow, a widely used Python imaging library, is susceptible to a memory disclosure vulnerability present between versions 5.3.0 and 13.0.0. This issue arises when libtiff decodes JPEG-compressed or Group 4 fax TIFF data, potentially allowing uninitialized memory to be returned as pixel data. Specifically, the _decodeStrip and _decodeTile functions could leave parts of the memory uninitialized, leading to exposure of stale heap contents. An attacker could exploit this weakness by submitting a specially crafted TIFF file to an application using Pillow, risking the unintended disclosure of sensitive information. This vulnerability has been addressed in version 13.0.0.

References