CVE-2026-112393
published 2026-10-19CVE-2026-112393: Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving…
PriorityP357critical9.2CVSS 4.0
AVNACHATPPRNUINVCHVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.82%
56.9th percentile
Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback sizes its allocation from the prior buffer size instead of the current write position, allowing an attacker-controlled out-of-line TIFF tag or retained ICC profile to be copied beyond the allocation after libtiff seeks forward. This overflow can crash the process and may allow code execution. Independently, unwritten alignment gaps in compressed TIFF output larger than 64 KiB can disclose stale heap bytes without a crafted tag. File paths and targets with real file descriptors are unaffected. This issue is fixed in version 13.0.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| python-pillow | pillow | — | — |
| python | pillow | >= 2.0.0 < 13.0.0 | 13.0.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
ghsa·2026-10-21
CVE-2026-112393 [CRITICAL] CWE-122 Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
```
Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
Location: src/libImaging/TiffDecode.c:94 in _tiffWriteProc()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
```
Pillow can write attacker-chosen data past the end of a heap buffer when it saves a TIFF image to an in-memory destination such as `io.BytesIO` rather than to a file. The same code also copies leftover heap memory from the process into the saved file. Anyone who can supply an image to a service that opens it and re-saves it as TIFF this way can trigger this with default settings. The attached reproducer crashes the process, and the overflow could potentially be developed further, but code execution is not demonstrated here.
The bug
VulDB
python-pillow Pillow up to 12.x TIFF Processing _tiffWriteProc heap-based overflow
vuldb·2026-10-19·CVSS 9.2
CVE-2026-112393 [CRITICAL] python-pillow Pillow up to 12.x TIFF Processing _tiffWriteProc heap-based overflow
A vulnerability was found in python-pillow Pillow up to 12.x and classified as critical. The affected element is the function _tiffWriteProc of the component TIFF Processing. The manipulation results in heap-based buffer overflow.
This vulnerability was named CVE-2026-112393. The attack may be performed from remote. There is no available exploit.
It is suggested to upgrade the affected component.
No detection rules found.
No public exploits indexed.
https://github.com/python-pillow/Pillow/commit/11582e5ffbdceb973d5ee593f3105af5a9852b40https://github.com/python-pillow/Pillow/releases/tag/13.0.0https://github.com/python-pillow/Pillow/security/advisories/GHSA-332p-7hrc-92wfhttps://github.com/python-pillow/Pillow/security/advisories/GHSA-332p-7hrc-92wf
2026-10-19
Published