CVE-2026-128067

Name of the Vulnerable Software and Affected Versions Pillow versions 2.3.0 through 12.3.0

Description Applications using this Python imaging library to save compressed TIFF images via libtiff may pass attacker-controlled image geometry tags to the encoder. The TiffImagePlugin. save path allows the ImageWidth, ImageLength, or SamplesPerPixel variables from exif=, tiffinfo=, or a source TIFF IFD to cause libtiff to consume a larger scanline than the buffer provided by ImagingLibTiffEncode. This can result in the reading of heap memory into the generated TIFF file or a process crash. Additionally, when TIFF Predictor 2 is enabled, libtiff may rewrite the oversized scanline in place, leading to memory corruption beyond the buffer. A PlanarConfiguration value of 2 may result in an undecodable output file.

Recommendations Update to version 13.0.0.