PT-2026-120293 — Heap Based Buffer Overflow in Pypi Pillow

PT-2026-120293 · Pypi · Pillow

Published

2026-10-20

Updated

2026-10-20

CVSS v3.1

6.5

Medium

Vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Summary

Pillow's libImaging decodeTile decoder, used to decode tiled TIFF images, allocates a per-tile buffer using realloc(state->buffer, TIFFTileSize(tiff)). After each TIFFReadTile it then iterates tile y from 0 up to current tile length and calls the configured row unpacker (here copy4) with the source pointer state->buffer + tile y * row byte size. When libtiff returns a tile bytes size smaller than the worst-case row byte size * tile length, the inner stride-and-copy loop walks past the realloc'd region and copy4 performs a 1024-byte memcpy that reads up to (tile length-1) * row byte size + row byte size bytes from a buffer sized only to tile bytes size. The supplied PoC TIFF triggers a 1024-byte over-read exactly 0 bytes past a 196608-byte allocation. An attacker who can convince a Pillow-using application to decode a crafted TIFF can trigger a process crash (DoS) and may cause adjacent heap memory to be copied into the decoded pixel buffer.

Details

Pillow's TIFF decoder, when libtiff reports the file is tiled, takes the decodeTile path. The function:

Asks libtiff for TIFFTileSize(tiff) (the bytes-per-tile) and TIFFTileRowSize(tiff) (the bytes per row as stored by libtiff).
Reallocates state->buffer to exactly tile bytes size.
For each tile origin (x, y) and each plane, calls TIFFReadTile into state->buffer, then walks the tile row by row, calling the configured ImagingShuffler (here copy4) on each row's worth of source bytes.

The validation done before the loop is:

if (tile bytes size > ((tile length * state->bits / planes + 7) / 8) * tile width) {
  state->errcode = IMAGING CODEC BROKEN;
  return -1;
}

This rejects oversized libtiff tiles, but it does not reject undersized ones — i.e. the case where libtiff returns a tile bytes size strictly less than row byte size * tile length. The loop body, however, indexes into the buffer assuming the buffer is at least row byte size * tile length bytes long.

Vulnerable Code

// src/libImaging/TiffDecode.c:446-490 — decodeTile
new data = realloc(state->buffer, state->bytes);  // bytes = tile bytes size
if (!new data) { ... }
state->buffer = new data;

for (y = state->yoff; y < state->ysize; y += tile length) {
  for (plane = 0; plane < planes; plane++) {
    ImagingShuffler shuffler = unpackers[plane];
    for (x = state->xoff; x < state->xsize; x += tile width) {
      if (TIFFReadTile(tiff, (tdata t)state->buffer, x, y, 0, plane) == -1) { ... }

      current tile width = min((INT32)tile width, state->xsize - x);
      current tile length = min((INT32)tile length, state->ysize - y);
      for (tile y = 0; tile y < current tile length; tile y++) {
        shuffler(
          (UINT8 *)im->image[tile y + y] + x * im->pixelsize,
          state->buffer + tile y * row byte size,  // <-- OOB stride
          current tile width
        );
      }
    }
  }
}

// src/libImaging/Unpack.c:1288-1291 — copy4 (the crash site)
static void
copy4(UINT8 *out, const UINT8 *in, int pixels) {
  /* RGBA, CMYK quadruples */
  memcpy(out, in, 4 * pixels);  // <-- ASAN-detected READ here
}

The PoC's tile metadata yields tile width = tile length = 256, row byte size = 1024 (4 bytes/pixel × 256 pixels), and tile bytes size = 196608 (which is 256·256·3 = three-channel-byte storage). The realloc'd buffer is 196608 bytes. The unpacker iterates tile y from 0 to 255 and for the highest rows the source pointer state->buffer + tile y * 1024 already lies at or past offset 196608 — the very last row's memcpy(in=buffer+255·1024, 1024) reads 1024 bytes starting 260096 - 196608 = 63488 bytes past the allocation; ASAN flags the very first byte past the heap region (READ of size 1024 at … 0 bytes after 196608-byte region).

The mismatch is real: libtiff's TIFFTileSize returns the packed per-tile storage (which depends on the file's photometric/separation layout — it can legitimately be smaller than row byte size × tile length), while the inner loop strides as if the buffer always equals row byte size × tile length.

Attribution

This issue was found by Anthropic from using Claude to study security of open source projects, and I am from Ada Logics helping validate the found issues and report to maintainers. The data in this report has been reviewed manually.

Fix

Heap Based Buffer Overflow

Found an issue in the description? Have something to add? Feel free to write us 👾

dbugs@ptsecurity.com

Weakness Enumeration

CWE-122

Related Identifiers

GHSA-462X-PGG6-55FP

Affected Products

Pillow