Pillow contains an out-of-bounds read issue when decoding certain malformed compressed TIFF files. The problem occurs in the ` decodeTile()` and ` decodeAsRGBA()` functions within `src/libImaging/TiffDecode.c`. When Pillow and libtiff interpret duplicated `PhotometricInterpretation` or `BitsPerSample` tags differently, Pillow may fail to verify that the required input row fits within the buffer produced by libtiff.
An attacker can exploit this by providing a crafted TIFF file that causes the unpacker to read past the end of a heap buffer. This can result in fragments of the process's heap memory, including pointer values, being copied into the output image pixels. In cases where the file is larger, it can lead to a process crash (segmentation fault).