CVE-2026-112896: Pillow Heap Out-of-Bounds Read Due to TIFF Encoder ColorMap Mismatch
Summary
CVE-2026-112896: Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read. Affects pillow versions < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a widely used Python Imaging Library that provides extensive capabilities for opening, manipulating, and saving various image file formats. It is particularly known for its ease of use and support for numerous image formats, including TIFF. However, a vulnerability has been identified in its TIFF encoder that can lead to serious security issues when processing certain TIFF files.
Vulnerability Detail
The vulnerability arises from a mismatch in the expected size of the ColorMap plane in the TIFF encoder of Pillow. When a specially crafted TIFF file is processed, the encoder allocates a fixed size for the ColorMap but does not reconcile this with the actual sample depth of the image. This can lead to a heap out-of-bounds read, potentially exposing sensitive process memory. The issue is triggered when an application saves a TIFF file with retained metadata, resulting in an attempted read of 131072 bytes from a 1536-byte allocation, which can cause application crashes and memory exposure.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid saving TIFF files with retained metadata if you are using a vulnerable version of Pillow. Alternatively, you can validate the TIFF files before processing them to ensure they do not contain malformed ColorMap entries.
Conclusion
CVE-2026-112896 represents a significant security vulnerability in the Pillow library, specifically affecting its TIFF encoder. Users are strongly advised to update to the latest version to mitigate potential risks associated with this vulnerability.
See every vulnerability recorded for pillow →
FAQ
CVE-2026-112896 is a security vulnerability in the Pillow library that allows for a heap out-of-bounds read when processing certain TIFF files with a mismatched ColorMap.
If your application uses Pillow to process TIFF files, it may be susceptible to crashes or memory exposure if it encounters a specially crafted TIFF file.
Versions of Pillow up to and including 12.3.0 are affected by this vulnerability. The issue is resolved in version 13.0.0 and later.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2026-112896 is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
