CVE-2026-112393

9.2Critical

Published 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

9.2Critical

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-122

Impact

Attackers can achieve remote code execution, crash the process, or leak stale heap memory by submitting malicious image metadata. They need the application to save compressed TIFF images to in-memory buffers like BytesIO.

Root cause

The _tiffWriteProc callback allocates memory based on the prior buffer size instead of the current write position when libtiff seeks forward on targets lacking a real file descriptor.

Affected systems

Pillow 2.0.0 through 12.x (before 13.0.0)

CVSS v4.0 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Upgrade Pillow to version 13.0.0 or later. If updating immediately is not possible, save TIFF output directly to a file descriptor or disk path rather than an in-memory stream like BytesIO.

shell

$ pip install --upgrade "Pillow>=13.0.0"

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback sizes its allocation from the prior buffer size instead of the current write position, allowing an attacker-controlled out-of-line TIFF tag or retained ICC profile to be copied beyond the allocation after libtiff seeks forward. This overflow can crash the process and may allow code execution. Independently, unwritten alignment gaps in compressed TIFF output larger than 64 KiB can disclose stale heap bytes without a crafted tag. File paths and targets with real file descriptors are unaffected. This issue is fixed in version 13.0.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-112393