CVE-2026-128066

Name of the Vulnerable Software and Affected Versions Pillow versions 1.0 through 12.3.0

Description In the Python imaging library, the ImageFileDirectory v2.load() function in src/PIL/TiffImagePlugin.py retains a separate bytes object for each out-of-line IFD (Image File Directory) tag value. This occurs without limiting the total data read or preventing multiple distinct tags from referencing the same file region. Consequently, a specially crafted TIFF or EXIF-bearing JPEG, PNG, WebP, or MPO file can cause memory consumption to grow quadratically relative to the input size. This process can be triggered during Image.open() for TIFF and some JPEG files, or when EXIF data is requested via getexif() or ImageOps.exif transpose(). Because metadata allocation is not bounded by declared pixel dimensions, standard decompression-bomb checks cannot prevent process memory exhaustion.

Recommendations Update Pillow to version 13.0.0.