CVE-2026-112395 · GHSA-462x-pgg6-55fp
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
- Risk score
- 48/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 19 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-copy loop walks beyond …
- Affected
- pillow (pip) >= 8.2.0, < 13.0.0
- Fix
- Upgrade pillow to 13.0.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| pillow | pip | >= 8.2.0, < 13.0.0 | 13.0.0 |
References
- https://github.com/advisories/GHSA-462x-pgg6-55fp
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-462x-pgg6-55fp
- https://nvd.nist.gov/vuln/detail/CVE-2026-112395
- https://github.com/python-pillow/Pillow/commit/76869efdbbf2ad7dccd7536520fb61b7a00ab61e
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0
- https://github.com/advisories/GHSA-462x-pgg6-55fp
Original description
Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-copy loop walks beyond that allocation. An attacker can supply a crafted tiled TIFF to an application that loads it. This can expose adjacent heap data in pixels or crash the process. This issue is fixed in version 13.0.0.
Last activity 19 Oct 2026. Patch Forecast updates every hour.