CVE-2026-112897: Pillow Vulnerability - Uninitialized Memory Exposure in TiffDecode
Summary
CVE-2026-112897: Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips. Affects pillow versions >= 5.3.0, < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pillow is a widely-used Python Imaging Library that provides extensive capabilities for opening, manipulating, and saving various image file formats. It is particularly known for its ease of use and support for numerous image processing tasks. However, a vulnerability has been identified in its TiffDecode functionality, which can lead to the exposure of uninitialized memory when processing certain TIFF files.
Vulnerability Detail
The vulnerability arises from the TiffDecode function in Pillow, specifically in the _decodeStrip() and _decodeTile() methods. When Pillow processes a crafted TIFF file with short JPEG strips, it fails to initialize memory properly. As a result, leftover memory from previous processes can be returned as image pixels. This can lead to the disclosure of sensitive information, as attackers can exploit this flaw to read uninitialized heap memory, potentially revealing private data. The issue is exacerbated by the fact that Pillow suppresses warnings from the underlying libtiff library, which could otherwise alert users to the problem.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid opening untrusted TIFF files or implement additional validation checks on the images before processing them. However, the best course of action is to update to the patched version of Pillow.
Conclusion
The vulnerability CVE-2026-112897 in the Pillow library poses a significant risk by exposing uninitialized memory when processing certain TIFF files. Users are strongly advised to update to the latest version of Pillow to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for pillow →
FAQ
CVE-2026-112897 is a vulnerability in the Pillow library that allows uninitialized memory to be returned as image pixels when processing certain TIFF files.
If your application uses Pillow to process images, it may inadvertently expose sensitive information from uninitialized memory when handling crafted TIFF files.
The vulnerability affects Pillow versions from 5.3.0 up to, but not including, 13.0.0.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
