CVE-2026-112404

Name of the Vulnerable Software and Affected Versions Pillow versions 8.1.0 through 12.x

Description Pillow contains an out-of-bounds read issue when decoding certain malformed compressed TIFF files. The problem occurs in the decodeTile() and decodeAsRGBA() functions within src/libImaging/TiffDecode.c. When Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow may fail to verify that the required input row fits within the buffer produced by libtiff.

An attacker can exploit this by providing a crafted TIFF file that causes the unpacker to read past the end of a heap buffer. This can result in fragments of the process's heap memory, including pointer values, being copied into the output image pixels. In cases where the file is larger, it can lead to a process crash (segmentation fault).

Recommendations Update Pillow to version 13.0.0. As a temporary mitigation, restrict the processing of untrusted TIFF files until the update is applied.