CVE-2026-112404: fallo de gravedad alta en python-pillow Pillow
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 0.4%
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not verify that the required input row fits inside the row libtiff produced, while the strip path has this validation. Loading pixels from such a crafted TIFF can expose adjacent heap data in output pixels or crash the process. This issue is fixed in version 13.0.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
python-pillow · PillowCVEs relacionadas — python-pillow Pillow
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-112900CRITICALPillow: Argument Injection in Ghostscript call, potentially leading into RCEEPSS 1.3%CVE-2026-112393CRITICALPillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIOEPSS 1.0%CVE-2026-112403CRITICALPillow: Heap buffer overflow in ImagingJpegDecodeEPSS 0.9%CVE-2026-112398CRITICALPillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code executionEPSS 0.7%CVE-2026-112396MEDIUMPillow: Heap use-after-free when encoding TIFF to an in-memory bufferEPSS 0.7%CVE-2026-40192HIGHPillow is vulnerable to a FITS GZIP decompression bombEPSS 0.7%