CVE-2026-112902: Pillow Memory Disclosure and Segfault via Crafted TIFF Tags
Summary
CVE-2026-112902: Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags. Affects pillow versions < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a widely-used Python Imaging Library that provides extensive capabilities for opening, manipulating, and saving various image file formats. It is particularly known for its ease of use and support for numerous image formats, including TIFF, JPEG, and PNG. However, a critical vulnerability has been identified in its TIFF encoding functionality, which can lead to severe memory disclosure and application crashes.
Vulnerability Detail
The vulnerability arises from a flaw in the libtiff encoder within Pillow, specifically in the function PyImaging_LibTiffEncoderNew. When processing crafted TIFF files, Pillow can inadvertently copy an attacker-controlled amount of process memory into the output TIFF file or cause a segmentation fault (SIGSEGV). This occurs when the application saves images as TIFF, especially when the uploaded file is compressed. The vulnerability allows an attacker to exploit the memory management of the application, potentially leading to information disclosure or application crashes. The issue is exacerbated by the fact that the memory read can be from sensitive areas of the process's memory space, making it a high-risk vulnerability with a CVSS score of 8.8.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing TIFF files, especially those that are compressed, until the library is updated. If TIFF processing is necessary, ensure that the input files are from trusted sources and validate the contents before processing.
Conclusion
The vulnerability CVE-2026-112902 in the Pillow library poses significant risks, including memory disclosure and application crashes. Users are strongly advised to update to the latest version of Pillow to mitigate these risks. For those unable to update immediately, it is crucial to avoid processing untrusted TIFF files.
See every vulnerability recorded for pillow →
FAQ
CVE-2026-112902 is a vulnerability in the Pillow library that can lead to memory disclosure and application crashes when processing crafted TIFF files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
If you cannot update Pillow immediately, avoid processing TIFF files and ensure that any files you do process come from trusted sources.
You can visit Vulert.com, which monitors and alerts in real-time for open-source vulnerabilities in software using just the Pipfile.lock.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
