CVE-2026-112393: Pillow Heap Buffer Overflow Vulnerability When Saving TIFF to BytesIO
Summary
CVE-2026-112393: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO. Affects pillow versions >= 2.0.0, < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pillow is a widely-used Python Imaging Library that provides extensive capabilities for opening, manipulating, and saving various image file formats. It is particularly known for its ease of use and support for a wide range of image formats, including TIFF, JPEG, PNG, and more. However, a critical vulnerability has been identified in its TIFF handling functionality, specifically when saving images to in-memory objects like BytesIO. This vulnerability can lead to severe security risks if exploited by malicious users.
Vulnerability Detail
The vulnerability arises from a heap buffer overflow in the _tiffWriteProc function located in src/libImaging/TiffDecode.c. When Pillow saves a TIFF image to an in-memory destination, it can write attacker-controlled data beyond the end of a heap buffer. This occurs because the function incorrectly calculates the size for reallocating memory, allowing an overflow of up to 2384 bytes. The overflow can lead to a crash of the process and potentially allow for code execution if exploited. The vulnerability has existed since version 2.0.0 and affects all versions up to 13.0.0.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using Pillow's save functionality to write TIFF images to in-memory objects like BytesIO. Instead, save images directly to a file path, which does not trigger the vulnerability.
Conclusion
The CVE-2026-112393 vulnerability in Pillow poses a significant risk due to its potential for heap buffer overflow and code execution. Users are strongly advised to update to the latest version of the library to protect their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for pillow →
FAQ
CVE-2026-112393 is a critical vulnerability in the Pillow library that allows for a heap buffer overflow when saving TIFF images to in-memory destinations.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your application's Pipfile.lock.
Exploitation of this vulnerability can lead to application crashes and potentially allow attackers to execute arbitrary code within the affected process.
Yes, a patch is available in version 13.0.0 of Pillow. It is recommended to update to this version to mitigate the risk.
If an immediate update is not possible, avoid saving TIFF images to BytesIO and instead save them directly to a file path to prevent exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
