CVE-2026-112404
Summary
by MITRE • 10/20/2026
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not verify that the required input row fits inside the row libtiff produced, while the strip path has this validation. Loading pixels from such a crafted TIFF can expose adjacent heap data in output pixels or crash the process. This issue is fixed in version 13.0.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
Xxx Xxxxxxxxxxxxx Xxxxxxxxxx Xx Xxxxxx Xxxxxxxx Xxxxxxx Xxxx X.x.x Xx Xx.x.x Xxxxxxxxxx X Xxxxxxxx Xxxxxx Xxxxxx Xxxx Xxxxxx Xxx Xxxxxxx'x Xxxxxxxx Xx Xxxxxx Xxxxx Xxxx Xxxxxx Xxxx Xxxxxx, Xxxxxxxxxxxx Xxxxxxxxx Xxx Xxxx-xxxxx Xxx Xxxx Xxxxxxxx Xxxxxxxx. Xx X Xxxxxx Xxxxxxx Xxxxxx Xxxxxxx Xxxxxxx Xxxx Xxxxxxxxxxx Xxx Xxxxx Xxxxxxxxxx Xxxxx Xxxxxx Xxx Xxxxxxxxxxxx, Xxxx Xxxxxxxx Xxxxxxxxx, Xxx Xxxxxxxxx Xxxxxxx, Xxxxxx Xxxxxx Xx Xxxxxxx Xx Xxx Xxxxxxxxxx X Xxxxxxx Xx Xxxxx Xxxxxxx Xxxxx Xxxxxxxxxx. Xxx Xxxx Xxxxxxxxx Xxxx Xxxxxx Xxxx Xx Xxxxxxxxxxxxx Xx Xxx Xxxxxx Xxxxxxxxx Xxxxx Xxxxxxxxxx Xxxxxxx Xxx Xxxxxx Xxxx Xxxxxxxx Xx Xxxxxxx Xxxxxx Xxxxxxxx Xxxxxxxx Xxxxxxxxxx. Xxxx X Xxxxxxx Xxxx Xxxx Xxxxxxxx Xxxxxxxxxx Xxxxxxxxxxxxxxxxxxxxxxxxx Xx Xxxxxxxxxxxxx Xxxx, Xxxxx Xx X Xxxxxxxxxx Xxxxxxx Xxx Xxxxxx Xxx Xxxxxxx Xxxxxxxxx Xxxxx Xxxxxxxx Xxxxxx. Xxxx Xxxxxxxxxxx Xxxxx Xx X Xxxxxxxxx Xxxxx Xxxxxx Xxxxxxxxxx Xx Xxxxxxxx Xxx Xxxx Xxxx Xxxxxxx Xxx Xxxxxx Xxxxxx Xx Xxxxx Xxxx Xxxxxxxxx Xx Xxxxxxx Xxx Xxxx Xxxxxxxx Xxx.
Xx Xxx Xxxxxxxx Xxxx Xxxxx, Xxxxxxxxxxxx Xxxxxx Xxx _xxxxxxxxxx Xxxxxxxx Xxx Xxx Xxxx Xxxxxxxx Xxxxx, Xxxxx Xx X Xxxxxxx Xxxxxxxx Xxxxx. Xxxxxx Xxx Xxxxx Xxxxxxxx Xxxx Xxxxx Xxxxxxxxx Xxxxxxxx Xxxx Xxx Xxxxxxxx Xxxxx Xxx Xxxx Xxxxxx Xxx Xxxxxx Xx Xxx Xxxx Xxxxxxxx Xx Xxxxxxx, Xxx Xxxx Xxx Xxxx Xxxxx Xxxxxxx Xx Xxxx Xxxxx Xxxx Xxxxxxx Xxxx Xxxxxxx Xxxxxxxxxx. Xxxxxxxxxxxx, Xxxx Xxxxxxxxxx Xxxx Xxxxxxxxx Xx Xxxxxxxxxxx Xxxxxxx Xxxx Xxxxx, Xxxxxx Xxxxxxxx Xx Xxxxxx Xxxxxx Xxxxxxxxx Xxxxxx Xxx Xxxxxxxxx Xxxxxx Xxx Xxx Xxxxxxx Xxxxx Xxx. Xxxx Xxx-xx-xxxxxx Xxxx Xxxxxxxxx Xxxxxx Xx Xxxxxxxx Xx Xxxxxx Xxxxxxxx Xxxx Xxxx Xxxx Xxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx Xxxx Xxxxx Xxxxx Xx Xxx Xxxxxxxxxxx'x Xxxxxx Xxxxx, Xxxxxxx Xx X Xxxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx Xxxxxxxxxxxxx. Xxxxxxxxxxx, Xxxxxxxxx Xx Xxx Xxxxxxxx Xxxxxx Xxxxxx Xxx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx Xx Xxxx Xxxxxxxxx Xxxxx Xxxx, Xxx Xxxxxxx Xxx Xxxxxx Xxxxxxxx Xxx Xxxxx, Xxxxxxxxx Xx X Xxxxxx Xx Xxxxxxx Xxxxxxxxx Xxx Xxx Xxxxxxx Xxxxxxx Xx Xxxxxx Xxx Xxxxx Xxxxxxxxxx.
Xxxx X Xxxxxxxxxxxxxx Xxxxxxxxxxx, Xxxx Xxxx Xxxxxx Xxxx Xxx-xxx Xxx-xx-xxxxxx Xxxx, Xx Xx Xxxxxxxx Xxxxxxx Xxxxxx Xxxxx Xxxxxx Xxxxxxxxxx, Xxxxx Xx Xxxxx X Xxxxxxxxx Xx Xxxx Xxxxxx Xxxxxxxx Xxxx Xx Xxxxxxxxx Xxxx Xxxxxxxxx Xx Xxx Xxxx Xxxx Xxxxxxxxxx Xxxxxxx Xxxx Xx Xx Xxxxxxx Xxxx Xxxx Xxxxxx Xx Xxxxx Xxxxxxxx. Xx Xxxxx Xx Xxxxxxxxx Xxxxxxx, Xxxx Xxxxxxxxxxxxx Xxx Xx Xxxxxxxxx Xxxxxx Xxx Xxx&xx Xxxxxxxxx Xxxxx Xxxxxxxxxx Xxxxxxx Xx Xxxxxxxxxx Xxx Xxxxxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxx, Xxxxxxxxxxxx Xxxxxxx Xxxxx Xxxxx Xxxx Xxxxxxxxxx Xxxx Xxxxx Xx Xxxxxxxxxxx Xxxxxxx. Xxx Xxxxxx Xxxxxxx Xxxxxx Xxxxxx Xxxxxxx; Xxxxxxxxxx Xxxxxxxxxxxx Xxxxx Xxxxx Xx Xxxxxxxx Xx Xxxx Xxxxxxxxx Xxxx Xxxxxxxx Xx Xxxxxxxx Xxxxxx Xxxxxxx, Xxxx Xx Xxxxxxxxxxxxxx Xxxxxx, Xxxxxxx Xxxx, Xx Xxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxx Xx Xxx Xxxx Xxxxxxxxxxx Xxxxxxxx.
Xxxxxxxxxx Xxx Xxxx Xxxxxxxxxxxxx Xxxxxxxx Xxxxxxxxx Xxxxxxxxx Xx Xxx Xxxxxx Xxxxxxx Xx Xxxxxxx Xx.x.x Xx Xxxxx, Xxxxx Xxx Xxxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxx Xxxxxxxx Xxxxxx Xx Xxxxxx Xxxx Xxxxx Xxx Xxxxx Xxx Xxxxxxxxx Xxxxxxx Xxx Xxxxxx Xxxx Xxxxxxxx Xx Xxxxxxx Xxxxxx Xxx Xxxxxxxx Xxxxx, Xxxxxxxxx Xxxxx Xxx Xxxx Xxxxxxxxx. Xxx Xxxxxxxxxxxxx Xxxxxx Xx Xxxxxxx Xxxxxxxxxxx Xxx Xx Xxxxxxxxxx Xxxxxxxxxxx, Xxxxxxxxxxxx Xxxxxx Xxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxx Xxxxxx Xxxx Xxxxx Xxxxxx Xx Xxxxxxxxxxx. Xxxx Xxxxxxxx Xxxxxxxxx Xxxxx Xxxxxxxxxx Xxx Xxxxxxxx Xxxxxxxxxxx Xxxxx Xxxxxxxxxxx Xxxxx Xx Xxxxxxxxx Xxxx Xxxxxxx Xxxxxxxx Xxxxxxxxx Xxxx Xxxxx Xxxxxxxxx Xxxxxxxx Xx Xxx Xxxxxxxxxx Xxxxxxxx. Xxxxxxxxxxxx, Xxxxxxxxx Xxxxx Xxxxxxxx Xxxxxx Xxxxxxxxx Xxxxxxxxxxxx Xxxx Xxxxxxxxxx Xxxxxx Xxxxxx Xxx Xxxx Xxxxxxxx Xxx Xxxxxx Xx Xxxxxxxxx Xxxx Xxxx Xxxxxxxx Xx Xxxxxxxx Xxxx Xx Xxxxxxxx Xxxxx Xxxxxxxx Xxxx Xx Xxx Xxx-xx-xxxxxx Xxxx Xx Xxxxxxxxxxxx Xxxxxxxx.