Invalid Memory Read Vulnerability in Pillow Python Imaging Library
CVE-2026-112902

8.3HIGH

Key Information:

Vendor

Python-pillow

Status
Pillow
Vendor
CVE Published:
5 November 2026

What is CVE-2026-112902?

The Pillow Python imaging library is vulnerable due to improper handling of TIFFSetField() arguments in versions up to 12.3.0. This flaw allows attacker-controlled image metadata to trigger invalid memory reads when saving compressed TIFF images. As a result, memory from the process may inadvertently be exposed in the encoded output, leading to significant security risks. The issue primarily affects applications that retain EXIF metadata during conversions. Users are encouraged to update to version 13.0.0 or later to mitigate this vulnerability.

Affected Version(s)

Pillow < 13.0.0

References

https://github.com/python-pillow/Pillow/security/advisori...
x_refsource_CONFIRM
https://github.com/python-pillow/Pillow/pull/10227
x_refsource_MISC
https://github.com/python-pillow/Pillow/commit/570df030c0...
x_refsource_MISC

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.