CVE-2026-112395
published 2026-10-19CVE-2026-112395: Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In…
PriorityP346high8.2CVSS 3.1
AVNACLPRNUINSUCLINAH
EPSS
0.37%
30.3th percentile
Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-copy loop walks beyond that allocation. An attacker can supply a crafted tiled TIFF to an application that loads it. This can expose adjacent heap data in pixels or crash the process. This issue is fixed in version 13.0.0.
Affected
86 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform | automation-dashboard-rhel9 | — | — |
| exploit-intelligence | vulnerability-analysis-rhel9 | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| lightspeed-core | rag-tool-cpu-rhel9 | — | — |
| lightspeed-core | rag-tool-cuda-12.9-rhel9 | — | — |
| lightspeed-services-ocp | ocp-rules-rhel9 | — | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| python-pillow | pillow | — | — |
| python | pillow | >= 8.2.0 < 13.0.0 | 13.0.0 |
| python | pillow | >= 8.2.0 < 13.0.0 | 13.0.0 |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| rhai-early-access | docling-sdk-cuda-rhel9 | — | — |
| rhai-early-access | docling-serve-cuda-rhel9 | — | — |
| rhai | guidellm-rhel9 | — | — |
| rhaii | model-opt-cuda-rhel9 | — | — |
| rhaii | vllm-cpu-rhel9 | — | — |
| rhaii | vllm-cuda-rhel9 | — | — |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
ghsa·2026-10-20
CVE-2026-112395 [MEDIUM] CWE-122 Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
### Summary
Pillow's libImaging `_decodeTile` decoder, used to decode tiled TIFF images, allocates a per-tile buffer using `realloc(state->buffer, TIFFTileSize(tiff))`. After each `TIFFReadTile` it then iterates `tile_y` from 0 up to `current_tile_length` and calls the configured row unpacker (here `copy4`) with the source pointer `state->buffer + tile_y * row_byte_size`. When libtiff returns a `tile_bytes_size` smaller than the worst-case `row_byte_size * tile_length`, the inner stride-and-copy loop walks past the realloc'd region and `copy4` performs a 1024-byte `memcpy` that reads up to `(tile_length-1) * row_byte_size + row_byte_size` bytes from a buffer sized only to `tile_bytes_size`. The supplied PoC TIFF tr
VulDB
python-pillow Pillow up to 12.x Tiled-TIFF Decoder _decodeTile out-of-bounds (EUVD-2026-104606)
vuldb·2026-10-19·CVSS 6.5
CVE-2026-112395 [MEDIUM] python-pillow Pillow up to 12.x Tiled-TIFF Decoder _decodeTile out-of-bounds (EUVD-2026-104606)
A vulnerability was found in python-pillow Pillow up to 12.x. It has been rated as critical. This impacts the function _decodeTile of the component Tiled-TIFF Decoder. Performing a manipulation results in out-of-bounds read.
This vulnerability is identified as CVE-2026-112395. The attack can be initiated remotely. There is not any exploit available.
Upgrading the affected component is advised.
Red Hat
pillow: pillow: Information disclosure via crafted tiled TIFF image
vendor_redhat·2026-10-19·CVSS 6.5
CVE-2026-112395 [MEDIUM] CWE-125 pillow: pillow: Information disclosure via crafted tiled TIFF image
pillow: pillow: Information disclosure via crafted tiled TIFF image
A flaw was found in Pillow. Its tiled-TIFF image decoder does not properly restrict buffer boundaries when copying pixel data, leading to an out-of-bounds read. A remote attacker could exploit this vulnerability by providing a specially crafted tiled TIFF image to an application using the library. Successful exploitation could allow an attacker to obtain sensitive information from adjacent heap memory or cause a Denial of Service (DoS) by crashing the application.
Package: exploit-intelligence/vulnerability-analysis-rhel9 (Exploit Intelligence) - Out of support scope
Package: lightspeed-core/lightspeed-stack-rhel9 (Lightspeed Core) - Fix deferred
Package: lightspeed-core/rag-tool-cpu-rhel9 (Lightspeed Core) - Fix defer
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-19
Published