CVE-2026-112395: Pillow Buffer Overflow Vulnerability

CVE-2026-112395 Overview

CVE-2026-112395 is an out-of-bounds read vulnerability in Pillow, the widely used Python imaging library. The flaw affects versions from 8.2.0 up to 13.0.0 and resides in the tiled-TIFF decoder. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length. Pillow's stride-and-copy loop then walks beyond that allocation while copying four-byte pixels. An attacker who supplies a crafted tiled TIFF file to an application that loads it can expose adjacent heap data in the resulting pixels or crash the process. The issue is classified under CWE-122 (Heap-based Buffer Overflow) and is fixed in Pillow 13.0.0.

Critical Impact
A crafted tiled TIFF processed by any Pillow-based application can leak adjacent heap memory into decoded pixel data or crash the hosting process.

Affected Products

Pillow versions 8.2.0 through 12.x
Python applications that load untrusted TIFF images using Pillow
Downstream frameworks and services bundling vulnerable Pillow releases

Discovery Timeline

2026-10-19 - CVE-2026-112395 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-112395

Vulnerability Analysis

The vulnerability occurs in Pillow's tiled-TIFF decoding path implemented in src/libImaging/TiffDecode.c. Pillow uses libtiff's TIFFRGBAImage interface to decode tiled TIFF images into 32-bit RGBA pixels. The decoder assumes the libtiff-returned tile buffer size equals the row stride multiplied by the tile height. When libtiff returns a smaller allocation than that product, the subsequent stride-and-copy loop reads past the end of the heap buffer.

Because each pixel is copied as four bytes, the overread can traverse several rows beyond the valid allocation. The result is either a process crash or inclusion of adjacent heap memory in the output image. An application that returns the decoded image to a remote caller can leak that memory to an attacker.

Root Cause

The root cause is a missing size invariant between libtiff's returned tile buffer and Pillow's unpacker row width. The _decodeTile logic implicitly assumed that TIFFRGBAImage would always produce 32 bits per pixel of output. When the unpacker was configured with a different bit depth, the per-row copy size exceeded the actual allocation, producing a heap-based out-of-bounds read [CWE-122].

Attack Vector

Exploitation requires only that a vulnerable application loads an attacker-supplied TIFF image. Web services that accept image uploads, document processing pipelines, thumbnailing workers, and OCR systems are typical attack surfaces. No authentication or user interaction beyond submitting the file is required when the target is a network-exposed service.

         rows_per_block = state->ysize;
     }
 
+    // TiffRGBAImages are 32bits/pixel. If the unpacker reads more bits per pixel
+    // than that, (at least) the last row of the block will have a read buffer
+    // overflow.
+    if (state->bits != 32) {
+        state->errcode = IMAGING_CODEC_BROKEN;
+        return -1;
+    }
+
     if (!(TIFFRGBAImageOK(tiff, emsg) && TIFFRGBAImageBegin(&img, tiff, 0, emsg))) {
         state->errcode = IMAGING_CODEC_BROKEN;
         // nothing to clean up, just return

Source: Pillow commit 76869ef. The patch rejects any tiled TIFF whose unpacker bit depth is not 32, preventing the mismatch that caused the overread.

Detection Methods for CVE-2026-112395

Indicators of Compromise

Unexpected process termination or segmentation faults in Python workers that decode TIFF images using Pillow.
Decoded images that contain visually noisy stripes or garbage pixels at the bottom of tiles, indicating leaked heap memory.
Uploaded TIFF files with unusual tile dimensions or non-32-bit sample configurations arriving at image processing endpoints.

Detection Strategies

Inventory Python environments for Pillow versions between 8.2.0 and 12.x using pip show pillow or software composition analysis tools.
Add file-type and TIFF structure validation at ingress to reject tiled TIFFs with unusual bit-depth configurations.
Monitor crash telemetry from image-processing microservices for repeated faults correlated with uploaded TIFF files.

Monitoring Recommendations

Enable core dump collection on image-processing workers and alert on recurring crashes in libImaging or libtiff frames.
Log hashes and metadata of uploaded images to support retrospective hunting if exploitation is suspected.
Track outbound responses from image APIs for abnormally sized or malformed decoded images that may indicate heap data exposure.

How to Mitigate CVE-2026-112395

Immediate Actions Required

Upgrade Pillow to version 13.0.0 or later in all Python environments that process untrusted images.
Rebuild and redeploy container images, serverless functions, and virtual environments that pin older Pillow releases.
Audit third-party packages that depend on Pillow and ensure they allow the fixed version range.

Patch Information

The issue is fixed in Pillow 13.0.0. See the Pillow 13.0.0 release notes and GitHub Security Advisory GHSA-462x-pgg6-55fp for full details. The underlying code change is tracked in Pillow commit 76869ef.

Workarounds

Reject TIFF uploads entirely at the application boundary where feasible until patching is complete.
Validate TIFF headers and reject tiled TIFFs whose sample bit depth is not 32 bits per pixel before passing them to Pillow.
Isolate image decoding in sandboxed, resource-limited workers so that crashes or memory disclosure cannot affect other tenants.

bash

# Upgrade Pillow to the fixed version
pip install --upgrade 'Pillow>=13.0.0'

# Verify the installed version
python -c "import PIL; print(PIL.__version__)"