CVE-2026-112396
Summary
by MITRE • 10/20/2026
Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in ImagingLibTiffEncode; the error path then frees the output buffer without closing or clearing the TIFF handle, and later cleanup flushes through the write callback into freed memory, which can crash the process and may enable code execution. This issue is fixed in version 13.0.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
Xxx Xxxxxxxxxxxxx Xxxxxxxxxx Xxxxxxx Xxxxxx, X Xxxxxx Xxxx Xxxxxx Xxxxxxx Xxxxxxx Xxxx Xxxxxx Xx X Xxxx Xxxxxxxxx Xxx Xxxxx Xxxxxxxxxx Xxxxxx Xxxxxxxx Xxx Xxxxxxxxxxxx, Xxxx Xxxxxxx Xxxxxxxxx, Xxx Xxxxxxxxx Xxxxxxx. Xxx Xxxxxxxx Xxxx Xxxxxxx Xxxxxx Xxx Xxxxxxxxxxx Xxxxxxx Xxxxxx’x Xxxxxxxx Xxxxx Xxx Xxx Xxxxxxxxxx Xx Xxxxxxx Xxxx Xxxxxxxx Xxxxxx Xxxxx Xxxx Xxxxxx (xxxx) Xxxx Xxxxxxxx Xxx Xx-xxxxxx Xxxxxxx. Xxxx Xxxxx Xxxxxxxxx Xxxxxx Xxxxxxx Xx.x.x Xx Xxx Xxxxxxx, Xxxxxxxxx Xxx Xxxxxxxx Xxxx Xx.x.x Xxxxxxx. Xxx Xxxx Xxxxx Xx X Xxxx Xxx-xxxxx-xxxx Xxxxxxxxx Xxxxxxxxx Xx Xx Xxxxxxxx Xxxxx-xxxxxxxx Xxxxxxxx Xxxxxx Xxx Xxxxxxxxxxxxxxxxxxxx Xxxxxxxx. Xxxx Xx Xxxxxxxxxxx Xxxxxxxx Xx Xxxx Xxxx Xxxx Xxxxxxxxxx Xxxxxxxx-xxxxxxxxxx Xxxx Xxxx X Xxxxxxx Xxxxxx, Xxxxxxx Xxx Xxxxxx Xxxxxxxx Xxxxxxxxx Xx Xxxxxxxxxxx Xxxxxxx Xxxx Xxxxxx Xxx Xxxxxxxx Xxxxxxx.
Xxxx Xxxxxxxxxxxx Xxxx X Xxxxxxxxx, Xxx Xxxxxxx’x Xxxxx Xxxx Xxxxxxxx X Xxxxxxx Xxxxxxx Xxxx Xxxxx Xxx Xxxxxx Xxxxxx Xxxxxxxxx Xxx Xxx Xxxxx Xxxx. Xxxxxxx, Xxxx Xxxxxxxxx Xxxxx Xx Xxxxxxxx Xxxxx Xx Xxxxx Xxx Xxxxxxxxxx Xxxx Xxxxxx Xxxxxxxxxx Xxxx Xxx Xx-xxxxxx Xxxxxx. Xxxx Xxxxxxxxx Xxxxxx Xxxxxxxx Xxxxxxxx Xxx Xxxxxxx Xxxxx Xxxxxxxxxx Xxxxxx Xxx Xxxxxxxx Xxxxxxxxxx Xx Xxxxxxx. Xxxxxxxxxxxx, Xxxx Xxx Xxxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxx Xxxxxxxxxxxx Xxxxxxxx Xxx Xxx Xxxxxxx Xxxxxx Xx Xxxxxxx Xxxxxxxxx, Xx Xxxxxxx Xxxxxxx Xxxxxxxxxx Xxxx Xxxxxxx Xx Xxxxx Xxxxxxxxx Xxxx Xxxxxxx X Xxxxx Xxxxxxxx. Xxxxxxx Xxx Xxxxxxxxxx Xxxxxx Xxx Xxxxxxx Xxxx Xxxxx Xxx Xxx Xxxxxxxxx Xx Xxxxxxxx Xxxxxxxx Xxxx Xxx Xxxxxx, Xxxx Xxxxxxxx Xxxxxx Xxxx Xxxxxx Xxxx Xx Xx Xxxxxx Xxxxxxxxx Xx Xxx Xxxxxxxxxxx.
Xxxx Xxxx Xxx-xxxxx-xxxx Xxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxx Xxxxxx Xxx Xxxxxxx Xxxxxx Xxxxx. Xx Xxxx Xxxxxxxxx Xxxxxxxxx, Xxxxxxxxx Xxxxx Xxxxxx Xxxxx Xx Xxxxxxxxx Xxxxxxx, Xxxxxxx Xxxxxx Xx Xxxxxxx Xxx Xxx Xxxxxxxxxxx Xxxxxxx Xx Xxxxxx Xxx Xxxxx Xxxxxxxxxx Xxxxx. Xxxxxxx, Xxxxx Xxx Xxxxxx Xx Xxxx Xxxxxxxxxx Xxx Xxx Xxxxxxx Xx Xxxxxxx Xxxxx Xxxx Xxx Xxxx Xxxx, X Xxxxxxxxxxxxx Xxxxxxxx Xxx Xxxxxxx Xxxx Xxxx Xxxxxxxxx Xx Xxxxx Xxxxxxxxxxxxx Xx Xxxxxxx Xxxxxxxxx Xxxx Xxxxxxxxx. Xx Xxxxxxxxx Xxxxxxxx Xxxxxxxxx Xxxx Xxxxx Xxxx Xxxxxxxx Xxx Xxxxxxxxxxxxxx, Xx Xxxxxxxxx Xxx Xxxxxxxxxx Xxxxxx Xxxxxx Xx Xxxxxxxxx Xxxxxxxx Xxxxxxxx Xx Xxxxxx Xxxxxxxxx, Xxxxxxx Xxxxxxx Xxxxxx Xxxx Xxxxxxxxx Xxxxxxxxxxxx Xx Xxxxxxx Xxxxxxxxxx Xxxxxxxxx Xxxxx Xxxxxxx.
Xxxx X Xxxxxxxxxxxxxx Xxxxxxxxxxx, Xxxx Xxxxxxxxxxxxx Xxxxxx Xxxx Xxx-xxx: Xxx Xxxxx Xxxx, Xxxxx Xxxxxxxxx Xxx Xxxxxx Xx Xxxxxxxxxxx Xxxxx Xxxxxx. Xx Xxxx Xxxxxxx Xx Xxx-xx: Xxxxxxxx Xxxxx Xxxxxxxxxx, Xx Xxx Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxx Xx Xxxxxxxx Xxxx Xxxx Xxxxxx Xxxxxxxxxx Xxx Xxxxxxxx Xxxxxxx Xxxx Xxxxx Xx Xxx Xxxxxx Xxxxx. Xx Xxxxx Xx Xxxxxx Xxxxxxx Xxx Xxxxxxx, Xxxx Xxxx Xxx Xx Xxxxxxxxx Xxxxxx Xxx Xxxxx Xxx&xx Xxxxxxxxx Xxxxx Xxxxxxxxxx Xxxx Xx Xxxxx: Xxxxxxxxxxxx Xxx Xxxxxx Xxxxxxxxx Xx Xxxx Xx X Xxxxxx-xxxx Xxxxxxx Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxx Xxxxxxxxx Xxxxxx, Xx Xxxx Xxxxxxx Xxxxx Xxxxxx Xxxxxxxxxx Xxxxxxxxxxxx Xxxxxxxx Xxxx Xxxxxxxxxx Xxxxxxxxx Xxxxxxxxxx Xx Xxxxxx Xxxx Xxxxxxxxx.
Xx Xxxxxxxx Xxxx Xxxx, Xxxxxxxxxxxxx Xxxx Xxxxxx Xxxx Xxx Xxxxxxxxx Xx Xxxxxx Xxx Xxxxxxxx Xx Xxxxxxx Xx.x.x Xx Xxxxx, Xxxxx Xxx Xxxxx Xxxxxxxx Xxxxx Xxx Xxxx Xxxxxxxxx Xx Xxxxxxxx Xxxxx Xxx Xxxxx Xxx Xxxx Xxxxxx Xxxxxx Xxxxxxx Xxxxxxxxxx Xxxxxxx. Xxx Xxxxxxxxxxxx Xxxxxx Xx Xxxxxxxxxxx Xxxxxxx, Xxxxxxxxx Xxxxxxxx Xxxxxx Xxxxxxx Xxxxxxxxxxxx Xxxxxx Xxxxx Xxxxxxxxxx Xx Xxxxxxxx Xxxxx Xxxxx Xxxxx Xxxxxxxxxxx Xxxxxxxxx Xxxx Xxxxxxxx Xx Xxxxxxxxx Xxxxx Xxxxxxx Xxxx Xxxxxx Xxxxxxxxx Xxxx Xxxxxxxxxx Xxxxxx Xxxx Xxxxx Xxxxxx’x Xxxxxxxx Xxxxxxxx. Xxxxxxxxxxxx, Xxxxxxxxx Xxxxxxx Xxxxxxxxxxx Xxxx-xxxxxxxxxx Xxxxx Xx Xxxxxx Xxxxxx Xxxxxxxx Xxx Xxxx Xxxxxx Xxx Xxxxx Xxxxxxxxxxxx Xxxxxxxx Xxxxx Xx Xxxxxxxx Xxxx Xxxxxxxx Xxxxxxxx Xxxxxxxxxx Xxxx Xxx-xxxxx-xxxx Xxxxxxxxxxxxxxx.