CVE-2026-112393

Name of the Vulnerable Software and Affected Versions Pillow versions 2.0.0 through 12.9.9

Description A heap buffer overflow and stale-heap disclosure exist in the tiffWriteProc function when saving compressed TIFF data through libtiff to a target lacking a usable fileno(), such as BytesIO. The callback determines allocation size based on the prior buffer size rather than the current write position. This allows an attacker-controlled out-of-line TIFF tag or retained ICC profile to be copied beyond the allocation after libtiff seeks forward, which can lead to process crashes or remote code execution. Additionally, unwritten alignment gaps in compressed TIFF output exceeding 64 KiB can disclose stale heap bytes. File paths and targets with real file descriptors are not affected.

Recommendations Update to version 13.0.0.