CVE-2026-112395Medium· 6.5▾ SunlitPillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row str…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-copy loop walks beyond that allocation. An attacker can supply a crafted tiled TIFF to an application that loads it. This can expose adjacent heap data in pixels or crash the process. This issue is fixed in version 13.0.0.
Pillow >= 8.2.0, < 13.0.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112398Critical· 9.2Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
CVE-2026-112393Critical· 9.2Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
CVE-2026-112403Critical· 9.2Pillow: Heap buffer overflow in ImagingJpegDecode
CVE-2026-112390High· 8.2Pillow: Infinite loop in MIC n_frames when the embedded TIFF
CVE-2026-112394Medium· 6.3Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
CVE-2026-112391Medium· 6.3Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()