CVE-2026-112902

============================================================================
Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
Location: src/encode.c:1014 in PyImaging LibTiffEncoderNew()
Commit:  a707c6b21c313880d0771e54965d142dd42358b6
============================================================================

# src/PIL/TiffImagePlugin.py:1782
supplied tags = {**legacy ifd, **getattr(im, "tag v2", {})}
…
# :1959-1982
for tag, value in itertools.chain(ifd.items(), supplied tags.items()):
  if tag not in TiffTags.LIBTIFF CORE:
    …
    elif isinstance(value, (int, float, str, bytes)) or …:
      type = TiffTags.lookup(tag).type   # None for 50740, 50829, …
      if type:
        types[tag] = type
  if tag not in atts and tag not in blocklist:
    …
      atts[tag] = value           # plain int 4096

// src/encode.c:844   (is var length = 0 → writecount 1, passcount 0)
if (ImagingLibTiffMergeFieldInfo(&encoder->state, type, key int, is var length)) {
  … continue;
}
…
// src/encode.c:1013-1016
} else if (type == TIFF LONG || type == TIFF IFD) {
  status = ImagingLibTiffSetField(
    &encoder->state, (ttag t)key int, (UINT32)PyLong AsLong(value)
  );

50740 DNGPrivateData   type=BYTE  passcount=1 writecount=-1  (unchanged)
50829 ActiveArea     type=LONG  passcount=0 writecount=4  (unchanged)
65000 CustomField     type=LONG  passcount=0 writecount=1  (Pillow's definition, tag was unknown)

control tag 65000=4096 -> 4096
leak   tag 50740=65536 from a 356-byte upload -> 65536 bytes not present in input, head a661fcffc661fcff3360fcff7b61fcffd361fcff085ffcffe061fcff3360fcff
     leaked bytes found in imaging.so at file offset 0x57588
crash  tag 50829=64 -> child exit -11 (SIGSEGV)
BUG

diff --git a/Tests/test file libtiff.py b/Tests/test file libtiff.py
index 3d804ea4a..adc4633e4 100644
--- a/Tests/test file libtiff.py
+++ b/Tests/test file libtiff.py
@@ -395,6 +395,43 @@ class TestFileLibTiff(LibTiffTestCase):
     with pytest.raises(ValueError, match="Incorrect tag value type"):
       im.save(out, tiffinfo=ifd)
 
+  @pytest.mark.parametrize(
+    "tag, value",
+    (
+      # DNGPrivateData is a BYTE array with a count to libtiff
+      (50740, 4096),
+      # ActiveArea is a LONG array of four values to libtiff
+      (50829, 64),
+      (50829, (0, 0)),
+    ),
+  )
+  def test libtiff field definition(
+    self, tag: int, value: Any, monkeypatch: pytest.MonkeyPatch, tmp path: Path
+  ) -> None:
+    monkeypatch.setattr(TiffImagePlugin, "WRITE LIBTIFF", True)
+
+    ifd = TiffImagePlugin.ImageFileDirectory v2()
+    ifd[tag] = value
+    ifd.tagtype[tag] = TiffTags.LONG
+
+    out = tmp path / "temp.tif"
+    im = Image.new("L", (1, 1))
+    with pytest.raises(ValueError, match="libtiff field definition"):
+      im.save(out, tiffinfo=ifd)
+
+    # Values that match the libtiff definition are written
+    ifd = TiffImagePlugin.ImageFileDirectory v2()
+    ifd[50740] = b"private"
+    ifd.tagtype[50740] = TiffTags.BYTE
+    ifd[50829] = (0, 0, 1, 1)
+    ifd.tagtype[50829] = TiffTags.LONG
+    im.save(out, tiffinfo=ifd)
+
+    with Image.open(out) as reloaded:
+      assert isinstance(reloaded, TiffImagePlugin.TiffImageFile)
+      assert reloaded.tag v2[50740] == b"private"
+      assert reloaded.tag v2[50829] == (0, 0, 1, 1)
+
   def test inknames tag(
     self, monkeypatch: pytest.MonkeyPatch, tmp path: Path
   ) -> None:
diff --git a/src/encode.c b/src/encode.c
index 9e19e9002..cbbd09f0d 100644
--- a/src/encode.c
+++ b/src/encode.c
@@ -675,6 +675,106 @@ PyImaging ZipEncoderNew(PyObject *self, PyObject *args) {
 
 #include <string.h>
 
+/* C type that TIFFSetField reads from its arguments for a single value of
+  the given type: int, uint64 t, double or char * */
+static int
+tiff scalar arg type(TIFFDataType type) {
+  switch (type) {
+    case TIFF BYTE:
+    case TIFF SBYTE:
+    case TIFF UNDEFINED:
+    case TIFF SHORT:
+    case TIFF SSHORT:
+    case TIFF LONG:
+    case TIFF SLONG:
+    case TIFF IFD:
+      return 1;
+    case TIFF LONG8:
+    case TIFF SLONG8:
+    case TIFF IFD8:
+      return 2;
+    case TIFF FLOAT:
+    case TIFF DOUBLE:
+    case TIFF RATIONAL:
+    case TIFF SRATIONAL:
+      return 3;
+    case TIFF ASCII:
+      return 4;
+    default:
+      return 0;
+  }
+}
+
+/* Size of the values that TIFFSetField copies from an array of the given
+  type. libtiff stores custom RATIONAL arrays as floats. */
+static int
+tiff array item size(TIFFDataType type) {
+  switch (type) {
+    case TIFF BYTE:
+    case TIFF SBYTE:
+    case TIFF UNDEFINED:
+    case TIFF ASCII:
+      return 1;
+    case TIFF SHORT:
+    case TIFF SSHORT:
+      return 2;
+    case TIFF LONG:
+    case TIFF SLONG:
+    case TIFF IFD:
+    case TIFF FLOAT:
+    case TIFF RATIONAL:
+    case TIFF SRATIONAL:
+      return 4;
+    case TIFF DOUBLE:
+    case TIFF LONG8:
+    case TIFF SLONG8:
+    case TIFF IFD8:
+      return 8;
+    default:
+      return 0;
+  }
+}
+
+/* Check that a value which will be passed to TIFFSetField as a single value
+  of the given type, or as an array of len values, matches the definition
+  of the field that libtiff will use. */
+static int
+tiff field matches(
+  TIFFDataType field type,
+  int passcount,
+  int writecount,
+  TIFFDataType type,
+  int is var length,
+  Py ssize t len
+) {
+  if (field type == TIFF ASCII && !passcount) {
+    // TIFFSetField reads a null-terminated string
+    return !is var length && type == TIFF ASCII;
+  }
+  if (!is var length) {
+    // TIFFSetField reads a single value
+    return !passcount && writecount == 1 && tiff scalar arg type(type) &&
+        tiff scalar arg type(type) == tiff scalar arg type(field type);
+  }
+  // TIFFSetField reads a pointer to the values, preceded by the number of
+  // values if passcount is set. Otherwise, the number of values is fixed.
+  if (!tiff array item size(type) ||
+    tiff array item size(type) != tiff array item size(field type)) {
+    return 0;
+  }
+  return passcount || (writecount > 1 && len == writecount);
+}
+
+static int
+set tiff array field(
+  ImagingCodecState state, int key, int passcount, Py ssize t len, void *av
+) {
+  if (passcount) {
+    return ImagingLibTiffSetField(state, (ttag t)key, len, av);
+  }
+  return ImagingLibTiffSetField(state, (ttag t)key, av);
+}
+
 PyObject *
 PyImaging LibTiffEncoderNew(PyObject *self, PyObject *args) {
   ImagingEncoderObject *encoder;
@@ -689,7 +789,8 @@ PyImaging LibTiffEncoderNew(PyObject *self, PyObject *args) {
   PyObject *key, *value;
   Py ssize t pos = 0;
   int key int, status, is core tag, is var length, num core tags, i;
-  TIFFDataType type = TIFF NOTYPE;
+  int is known tag, passcount, writecount;
+  TIFFDataType type = TIFF NOTYPE, field type;
   // This list also exists in TiffTags.py
   const int core tags[] = {256, 257, 258,  259,  262,  263,  266, 269, 274, 277,
               278, 280, 281,  282,  283,  284,  286, 287, 296, 297,
@@ -777,6 +878,8 @@ PyImaging LibTiffEncoderNew(PyObject *self, PyObject *args) {
     status = 0;
     is core tag = 0;
     is var length = 0;
+    is known tag = 0;
+    passcount = 1;
     type = TIFF NOTYPE;
 
     for (i = 0; i < num core tags; i++) {
@@ -800,6 +903,15 @@ PyImaging LibTiffEncoderNew(PyObject *self, PyObject *args) {
         }
         Py DECREF(tag type);
       }
+
+      // libtiff uses its own definition for tags that it already knows,
+      // rather than the field registered below.
+      is known tag = ImagingLibTiffFindField(
+        &encoder->state, key int, &field type, &passcount, &writecount
+      );
+      if (is known tag && type == TIFF NOTYPE) {
+        type = field type;
+      }
     }
 
     if (type == TIFF NOTYPE) {
@@ -838,7 +950,7 @@ PyImaging LibTiffEncoderNew(PyObject *self, PyObject *args) {
 
     if (!is core tag) {
       // Register field for non core tags.
-      if (type == TIFF BYTE) {
+      if (type == TIFF BYTE || type == TIFF UNDEFINED) {
         is var length = 1;
       }
       if (ImagingLibTiffMergeFieldInfo(
@@ -847,6 +959,28 @@ PyImaging LibTiffEncoderNew(PyObject *self, PyObject *args) {
         Py DECREF(item);
         continue;
       }
+
+      if (is known tag) {
+        // Check that the value will be passed to TIFFSetField in the
+        // form that libtiff's definition of the tag expects.
+        Py ssize t len = 0;
+        if (PyTuple Check(value)) {
+          len = PyTuple Size(value);
+        } else if (PyBytes Check(value)) {
+          len = PyBytes Size(value);
+        }
+        if (!tiff field matches(
+            field type, passcount, writecount, type, is var length, len
+          )) {
+          Py DECREF(encoder);
+          Py DECREF(item);
+          PyErr SetString(
+            PyExc ValueError,
+            "Tag value does not match libtiff field definition"
+          );
+          return NULL;
+        }
+      }
     }
 
     if (type == TIFF BYTE || type == TIFF UNDEFINED ||
@@ -857,9 +991,10 @@ PyImaging LibTiffEncoderNew(PyObject *self, PyObject *args) {
         PyErr SetString(PyExc ValueError, "Incorrect tag value type");
         return NULL;
       }
-      status = ImagingLibTiffSetField(
+      status = set tiff array field(
         &encoder->state,
-        (ttag t)key int,
+        key int,
+        passcount,
         PyBytes Size(value),
         PyBytes AsString(value)
       );
@@ -909,8 +1044,8 @@ PyImaging LibTiffEncoderNew(PyObject *self, PyObject *args) {
           for (i = 0; i < len; i++) {
             av[i] = (UINT16)PyLong AsLong(PyTuple GetItem(value, i));
           }
-          status = ImagingLibTiffSetField(
-            &encoder->state, (ttag t)key int, len, av
+          status = set tiff array field(
+            &encoder->state, key int, passcount, len, av
           );
           free(av);
         }
@@ -922,8 +1057,8 @@ PyImaging LibTiffEncoderNew(PyObject *self, PyObject *args) {
           for (i = 0; i < len; i++) {
             av[i] = (UINT32)PyLong AsLong(PyTuple GetItem(value, i));
           }
-          status = ImagingLibTiffSetField(
-            &encoder->state, (ttag t)key int, len, av
+          status = set tiff array field(
+            &encoder->state, key int, passcount, len, av
           );
           free(av);
         }
@@ -935,8 +1070,8 @@ PyImaging LibTiffEncoderNew(PyObject *self, PyObject *args) {
           for (i = 0; i < len; i++) {
             av[i] = (INT8)PyLong AsLong(PyTuple GetItem(value, i));
           }
-          status = ImagingLibTiffSetField(
-            &encoder->state, (ttag t)key int, len, av
+          status = set tiff array field(
+            &encoder->state, key int, passcount, len, av
           );
           free(av);
         }
@@ -948,8 +1083,8 @@ PyImaging LibTiffEncoderNew(PyObject *self, PyObject *args) {
           for (i = 0; i < len; i++) {
             av[i] = (INT16)PyLong AsLong(PyTuple GetItem(value, i));
           }
-          status = ImagingLibTiffSetField(
-            &encoder->state, (ttag t)key int, len, av
+          status = set tiff array field(
+            &encoder->state, key int, passcount, len, av
           );
           free(av);
         }
@@ -961,8 +1096,8 @@ PyImaging LibTiffEncoderNew(PyObject *self, PyObject *args) {
           for (i = 0; i < len; i++) {
             av[i] = (INT32)PyLong AsLong(PyTuple GetItem(value, i));
           }
-          status = ImagingLibTiffSetField(
-            &encoder->state, (ttag t)key int, len, av
+          status = set tiff array field(
+            &encoder->state, key int, passcount, len, av
           );
           free(av);
         }
@@ -974,8 +1109,8 @@ PyImaging LibTiffEncoderNew(PyObject *self, PyObject *args) {
           for (i = 0; i < len; i++) {
             av[i] = (FLOAT32)PyFloat AsDouble(PyTuple GetItem(value, i));
           }
-          status = ImagingLibTiffSetField(
-            &encoder->state, (ttag t)key int, len, av
+          status = set tiff array field(
+            &encoder->state, key int, passcount, len, av
           );
           free(av);
         }
@@ -987,12 +1122,12 @@ PyImaging LibTiffEncoderNew(PyObject *self, PyObject *args) {
           for (i = 0; i < len; i++) {
             av[i] = PyFloat AsDouble(PyTuple GetItem(value, i));
           }
-          status = ImagingLibTiffSetField(
-            &encoder->state, (ttag t)key int, len, av
+          status = set tiff array field(
+            &encoder->state, key int, passcount, len, av
           );
           free(av);
         }
-      } else if (type == TIFF RATIONAL) {
+      } else if (type == TIFF RATIONAL || type == TIFF SRATIONAL) {
         FLOAT32 *av;
         /* malloc check ok, calloc checks for overflow */
         av = calloc(len, sizeof(FLOAT32));
@@ -1000,8 +1135,9 @@ PyImaging LibTiffEncoderNew(PyObject *self, PyObject *args) {
           for (i = 0; i < len; i++) {
             av[i] = (FLOAT32)PyFloat AsDouble(PyTuple GetItem(value, i));
           }
-          status =
-            ImagingLibTiffSetField(&encoder->state, (ttag t)key int, av);
+          status = set tiff array field(
+            &encoder->state, key int, passcount, len, av
+          );
           free(av);
         }
       }
diff --git a/src/libImaging/TiffDecode.c b/src/libImaging/TiffDecode.c
index 8a57c523d..e14dd50bb 100644
--- a/src/libImaging/TiffDecode.c
+++ b/src/libImaging/TiffDecode.c
@@ -923,6 +923,29 @@ ImagingLibTiffMergeFieldInfo(
   return TIFFMergeFieldInfo(clientstate->tiff, info, n);
 }
 
+int
+ImagingLibTiffFindField(
+  ImagingCodecState state,
+  int key,
+  TIFFDataType *field type,
+  int *passcount,
+  int *writecount
+) {
+  // Look up libtiff's own definition of a tag. TIFFMergeFieldInfo does not
+  // replace the definition of a tag that libtiff already knows, so this is
+  // what TIFFSetField will use for such tags.
+  TIFFSTATE *clientstate = (TIFFSTATE *)state->context;
+  const TIFFField *fip = TIFFFindField(clientstate->tiff, (ttag t)key, TIFF ANY);
+
+  if (!fip) {
+    return 0;
+  }
+  *field type = TIFFFieldDataType(fip);
+  *passcount = TIFFFieldPassCount(fip);
+  *writecount = TIFFFieldWriteCount(fip);
+  return 1;
+}
+
 int
 ImagingLibTiffSetField(ImagingCodecState state, ttag t tag, ...) {
   // after tif dir.c->TIFFSetField.
diff --git a/src/libImaging/TiffDecode.h b/src/libImaging/TiffDecode.h
index c31d0b9d8..ee1e4a5f9 100644
--- a/src/libImaging/TiffDecode.h
+++ b/src/libImaging/TiffDecode.h
@@ -41,6 +41,14 @@ ImagingLibTiffMergeFieldInfo(
   ImagingCodecState state, TIFFDataType field type, int key, int is var length
 );
 extern int
+ImagingLibTiffFindField(
+  ImagingCodecState state,
+  int key,
+  TIFFDataType *field type,
+  int *passcount,
+  int *writecount
+);
+extern int
 ImagingLibTiffSetField(ImagingCodecState state, ttag t tag, ...);
 
 /*