CVE-2026-112897

Name of the Vulnerable Software and Affected Versions Pillow versions 5.3.0 through 12.11.0

Description Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. This occurs because the decodeStrip and decodeTile buffers may be larger than the bytes written by libtiff, and Pillow converts the expected rows without clearing the unwritten tail. An attacker can provide a crafted TIFF file to an application that loads and returns or re-encodes pixels, potentially disclosing stale heap contents without causing memory corruption or a process crash.

Recommendations Update to version 13.0.0.