Key points
- Pillow versions 8.1.0 through 12.9.9 are affected by CVE-2026-112404.
- A patch is available in version 13.0.0.
- The flaw allows attackers to extract heap memory from image processing services.
Pillow version 13.0.0 is now available to fix a high-severity vulnerability in the library’s TIFF decoding logic. The flaw, tracked as CVE-2026-112404, affects all versions from 8.1.0 up to but not including 13.0.0. According to the GitHub advisory GHSA-c6hw-5grf-ff96, the issue allows an attacker to read beyond the end of a heap buffer. This results in sensitive memory data being copied into the resulting image pixels.
In plain English
When Pillow processes certain malformed compressed TIFF files, it reads more data than intended from the system's memory. The library then includes these extra bytes in the image it returns to the application. An attacker can craft a specific file that triggers this behavior. If a service processes this file, such as by generating a thumbnail, the attacker receives fragments of the process's heap memory. This can include pointer values and other sensitive information.
The background
The vulnerability exists in the `_decodeTile()` and `_decodeAsRGBA()` functions within `src/libImaging/TiffDecode.c`. These functions calculate buffer sizes based on libtiff's view of the pixel layout. However, they fail to verify that the unpacker's input fits within the row produced by libtiff. A discrepancy arises when a TIFF file contains duplicated tags like `PhotometricInterpretation`. Libtiff keeps the first occurrence, while Pillow keeps the last. This mismatch causes Pillow to read beyond the allocated buffer.
What changes now
Version 13.0.0 includes a fix for this out-of-bounds read. The patch adds necessary checks to ensure the unpacker's input remains within the bounds of the libtiff-produced row. This aligns the tile and RGBA paths with the `_decodeStrip()` function, which already had this protection added in version 8.2.0. The previous fix was introduced to address a different crash but was not applied to these specific decoding paths until now.
Who needs to act first
Security operations teams should prioritize updating systems that accept user-uploaded images for processing. Services that automatically generate thumbnails, previews, or converted images are at the highest risk. Teams should verify their current Pillow version and apply the 13.0.0 update immediately. Before rolling out the fix broadly, test it in a staging environment to ensure compatibility with existing applications. If immediate patching is not possible, consider restricting file uploads to trusted sources or using a sandboxed environment for image processing.
What to do and how to stay safe: Pillow
- Audit your infrastructure to identify all applications using Pillow versions 8.1.0 or later.
- Apply the update to version 13.0.0 on all affected systems as soon as possible.
- Review logs for any unusual image processing errors or crashes that may indicate exploitation attempts.
- Implement strict file validation to reject malformed TIFF files before they reach the decoder.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-112404?
The vulnerability is rated as high severity according to the GitHub advisory.
Which Pillow versions are vulnerable?
Versions 8.1.0 and later, up to but not including 13.0.0, are affected.
Is there a patch available?
Yes, version 13.0.0 contains the fix for this vulnerability.
