CVE-2026-112395

Name of the Vulnerable Software and Affected Versions Pillow versions 8.2.0 through 12.x.x

Description The tiled-TIFF decoder in the libImaging module contains a memory corruption issue. When processing tiled TIFF images, the decodeTile() function allocates a buffer based on the tile size reported by libtiff. However, the subsequent stride-and-copy loop assumes the buffer is at least as large as the row stride multiplied by the tile length. If libtiff returns a tile allocation smaller than this expected size, the copy4() function performs a memcpy that reads beyond the allocated heap buffer. An attacker can exploit this by providing a specially crafted TIFF file, which may lead to a process crash (denial of service) or the exposure of adjacent heap data within the decoded pixels.

Recommendations Update Pillow to version 13.0.0 or later.