Python Imaging Library Vulnerability in Pillow by Python Software Foundation

CVE-2026-128067

What is CVE-2026-128067?

The Pillow library, widely used for image processing in Python, is subject to a buffer overflow vulnerability when handling compressed TIFF images. By exploiting this flaw, attackers can manipulate image geometry tags, leading to the potential exposure of heap memory or even crashing the application. This vulnerability arises in the TiffImagePlugin._save path and can corrupt memory when TIFF Predictor 2 is active. Users are recommended to upgrade to version 13.0.0 or later to mitigate this risk.

References