CVE-2026-112902

Name of the Vulnerable Software and Affected Versions Pillow versions 5.4.0 through 10.2.0

Description A memory disclosure and segmentation fault issue exists when the software re-saves images as TIFF files using the libtiff encoder. The problem occurs in the PyImaging LibTiffEncoderNew() function within src/encode.c because the encoder does not correctly verify if the Python value being passed to the variadic TIFFSetField() function matches the field definition expected by libtiff.

An attacker can provide a crafted TIFF file containing specific tags that trigger this mismatch. For example, if a tag is defined by libtiff as a counted array but is passed as a scalar, libtiff may interpret the scalar value as a byte count and copy an arbitrary amount of process memory from a stale pointer into the output file. Alternatively, if a tag is defined as a fixed-size array, the scalar value may be used as a source memory address, leading to a process crash (SIGSEGV).

Technical details include:

Recommendations Update Pillow to version 10.3.0 or later. As a temporary mitigation, avoid re-saving images as compressed TIFF files or restrict the processing of TIFF files from untrusted sources.