Memory Exhaustion Vulnerability in Pillow Python Imaging Library

CVE-2026-128066

What is CVE-2026-128066?

The Pillow library, a widely used Python imaging library, suffers from a vulnerability that allows crafted TIFF or EXIF-bearing images to consume excessive memory. This occurs because the ImageFileDirectory_v2.load() function retains separate byte objects for each out-of-line IFD tag value without limits on the total data read. As a result, specially crafted images can lead to memory usage that escalates quadratically based on the input size. The issue is triggered during the parsing of TIFF and JPEG images, especially when the EXIF information is accessed. Notably, the pixel dimensions declared do not constrain this excessive metadata allocation, thus bypassing decompression-bomb checks and causing significant process memory exhaustion. The vulnerability has been addressed in version 13.0.0.

References