CVE-2026-112404: Pillow OOB Read Vulnerability Leading to Heap Memory Disclosure
Summary
CVE-2026-112404: Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels. Affects pillow versions >= 8.1.0, < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a widely used Python Imaging Library that provides extensive capabilities for opening, manipulating, and saving various image file formats. It is known for its ease of use and versatility, making it a popular choice among developers for image processing tasks. However, it has been found to contain a vulnerability that allows an attacker to read beyond the end of a heap buffer when decoding certain malformed TIFF files, potentially leaking sensitive information.
Vulnerability Detail
The vulnerability arises from an out-of-bounds (OOB) read in the TiffDecode.c file, specifically in the _decodeTile() and _decodeAsRGBA() functions. When Pillow processes certain malformed compressed TIFF files, it reads past the allocated buffer and copies the leaked data into the image pixels. This can lead to the disclosure of sensitive heap memory, including pointer values, to an attacker who can manipulate the input file. The issue is exacerbated by the fact that the two parsers (libtiff and Pillow) can disagree on the pixel layout, allowing for exploitation through crafted TIFF files.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted TIFF files or implement strict validation checks on the input files to ensure they conform to expected formats before decoding them with Pillow.
Conclusion
The CVE-2026-112404 vulnerability in Pillow poses a significant risk by allowing attackers to read sensitive heap memory through malformed TIFF files. Users are strongly advised to update to the latest version of Pillow to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for pillow →
FAQ
CVE-2026-112404 is a vulnerability in the Pillow library that allows for an out-of-bounds read, potentially leaking sensitive heap memory when processing malformed TIFF files.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities in real-time.
The vulnerability can lead to the disclosure of sensitive information from the application's heap memory, including pointers, which could be exploited by attackers.
You can update Pillow to the patched version by running the command 'pip install --upgrade pillow' in your terminal or command prompt.
Yes, a slightly larger malformed TIFF file can cause the application to crash, as the out-of-bounds read may lead to segmentation faults.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
