CVE-2026-112396

Name of the Vulnerable Software and Affected Versions Pillow versions 11.3.0 through 12.x

Description A heap use-after-free occurs when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. This happens when an application saves attacker-influenced TIFF tags to BytesIO, causing libtiff to reject a tag during encoding in the ImagingLibTiffEncode() function. The error path frees the output buffer without closing or clearing the TIFF handle, leading to a subsequent cleanup process that flushes data through the write callback into the freed memory. This can result in a process crash or potential arbitrary code execution.

Recommendations Update to version 13.0.0.