Python Imaging Library 13.0.0 fixes out-of-bounds read in TIFF saving logic to prevent heap disclosure

Python imaging library Pillow has released version 13.0.0 to resolve a high-severity vulnerability in its TIFF encoder. This update addresses an out-of-bounds read flaw that can expose heap memory or crash applications processing specific image files.

What happened

The vulnerability, identified as CVE-2026-112896, carries a CVSS score of 8.8 and is classified as high severity. According to the National Vulnerability Database, the flaw affects all Pillow versions prior to 13.0.0. The issue stems from how the library handles TIFF metadata during the encoding process. Specifically, the encoder fails to reconcile plane sizes with the BitsPerSample value when retaining metadata.

A crafted TIFF file can contain a ColorMap buffer that is inconsistent with the image's sample depth. When an application opens such a file and then saves it back to TIFF format, the encoder allocates a small buffer but passes pointers to libtiff expecting a much larger read. This mismatch triggers an out-of-bounds read operation.

The GitHub security advisory details that a small, valid-looking TIFF can trigger this flaw. The file does not need to be forged with complex Python objects. Instead, it relies on standard tags, such as a ColorMap with specific SHORT values, that are accepted upon loading. When the application invokes the save path, libtiff attempts to read far beyond the allocated memory space.

This process can disclose heap memory contents in the output file or cause the application process to crash. The advisory notes that while memory exposure is a potential consequence, the report does not demonstrate the extraction of arbitrary heap contents. No code execution or address-space bypass is claimed for this specific vulnerability.

Why it matters

This vulnerability requires a specific application behavior to exploit. An attacker must supply a crafted TIFF file that the application opens and subsequently saves. Applications that merely display images without re-encoding them are not affected by this specific encoder path. However, many image processing tools retain metadata during save operations, making them potential targets.

The flaw was observed in testing on CPython 3.11.8 running on macOS ARM64 with Pillow 12.3.0. The issue exists because accepted metadata is forwarded during saving without checking for consistency with the effective sample depth. This oversight allows the underlying libtiff library to perform unsafe memory reads based on incorrect size expectations.

As Patch Gazette reported on October 20, 2026, Pillow 13.0.0 also resolves a separate critical heap overflow in TIFF handling. This latest patch adds another layer of protection for users who rely on the library for image manipulation tasks.

What to watch

• Check if your applications open and save TIFF files with retained metadata.
• Monitor for any new advisories regarding Pillow version compatibility.
• Review logs for unexpected process crashes during image encoding tasks.
• Verify that your deployment pipeline can deploy version 13.0.0 quickly.

Who needs to act first

Teams should prioritize updating systems that process untrusted image uploads. Applications that allow users to submit TIFF files and then save or convert them are at the highest risk. Before deploying the update, test the new library version in a staging environment to ensure compatibility with existing workflows. Back up current configurations and image processing scripts to facilitate a quick rollback if issues arise. Reduce exposure by restricting the types of images accepted by public-facing services until the patch is widely deployed.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Pillow

• Update Pillow to version 13.0.0 or later on all affected systems.
• Review application code to see if it saves TIFF files with retained metadata.
• Monitor application logs for crashes or errors related to TIFF encoding.
• Restrict input to trusted sources if immediate patching is not possible.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Pillow are vulnerable to CVE-2026-112896?

All versions of Pillow prior to 13.0.0 are affected by this vulnerability.

Does opening a crafted TIFF file trigger the vulnerability?

No, the application must open the file and then save it back to TIFF format to trigger the out-of-bounds read.

Is there a confirmed fix for this vulnerability?

Yes, the issue is fixed in Pillow version 13.0.0.