CVE-2026-112395: 
Python vulnerability analysis and mitigation

CVE-2026-112395 is a heap-based buffer over-read vulnerability in Pillow's tiled-TIFF decoder that allows an unauthenticated network attacker to expose adjacent heap memory or crash the process by supplying a crafted TIFF file. It affects Pillow versions 8.2.0 through 12.3.0 (inclusive) and is fixed in version 13.0.0. The vulnerability was published on October 19, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is an out-of-bounds read (CWE-125) combined with a heap-based buffer overflow condition (CWE-122) in src/libImaging/TiffDecode.c within the _decodeTile function. When decoding tiled TIFF images, Pillow calls TIFFTileSize(tiff) to determine the per-tile allocation size and reallocs state->buffer to exactly that size. However, libtiff can legitimately return a tile_bytes_size smaller than row_byte_size * tile_length (e.g., for multi-plane or photometric configurations), and Pillow's inner loop strides through the buffer as if it were always row_byte_size * tile_length bytes long — causing the copy4 unpacker (Unpack.c:1290) to perform a memcpy that reads past the allocated heap region. The existing validation only rejected oversized tiles, not undersized ones, leaving the undersized case exploitable. The fix (commit 76869ef) adds an explicit check rejecting any TIFF where unpacker_row_byte_size > row_byte_size (GitHub Advisory, Pillow Commit).

Successful exploitation can result in two outcomes: a process crash (denial of service) when the out-of-bounds read triggers a segmentation fault or ASAN abort, and potential memory disclosure where adjacent heap data is copied into the decoded pixel buffer and subsequently returned to the caller. Because no authentication or user interaction is required, any application that accepts TIFF image uploads from untrusted sources and processes them with a vulnerable Pillow version is at risk. Sensitive heap data — such as cryptographic material, session tokens, or other in-memory secrets — could be exposed to an attacker via the returned image pixel data (GitHub Advisory, Red Hat CVE).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat CVE). The EPSS score is 0.0, indicating very low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. A PoC TIFF file was included in the security advisory to demonstrate the ASAN-detected over-read, but it has not been weaponized into a public exploit kit (GitHub Advisory).

1. Identify a target application: Locate a web application or service that accepts TIFF image uploads and processes them using Pillow versions 8.2.0–12.3.0 (e.g., image processing pipelines, document converters, or photo management tools).
2. Craft a malicious tiled TIFF: Construct a TIFF file with tiled layout metadata where the PhotometricInterpretation or SamplesPerPixel tags cause Pillow to select an unpacker (e.g., copy4, 4 bytes/pixel) while libtiff decodes fewer bytes per row (e.g., 3 bytes/pixel for a 3-channel image). Set tile_width = tile_length = 256, yielding row_byte_size = 1024 but tile_bytes_size = 196608 (256×256×3), creating a mismatch.
3. Submit the crafted TIFF: Upload or send the malicious TIFF to the target application's image processing endpoint.
4. Trigger the over-read: When Pillow's _decodeTile processes the file, the stride-and-copy loop walks past the 196608-byte allocation; for the last rows, copy4 performs a memcpy reading up to 1024 bytes beyond the heap allocation.
5. Observe the outcome: The process may crash (DoS), or the adjacent heap memory may be incorporated into the decoded pixel buffer and returned to the attacker as image data, potentially disclosing sensitive in-memory information (GitHub Advisory).

• Logs: Application error logs showing OSError: decoder error -2 or unexpected crashes/segmentation faults when processing TIFF files; ASAN reports referencing READ of size 1024 near copy4 in Unpack.c:1290 or _decodeTile in TiffDecode.c.
• File System: Presence of unusual or malformed .tif/.tiff files in upload directories, particularly those with mismatched PhotometricInterpretation, SamplesPerPixel, or BitsPerSample tags relative to tile geometry.
• Process: Unexpected process crashes or restarts of image-processing worker processes; core dump files generated by the Pillow-using application process.
• Network: Repeated TIFF upload requests from a single source IP, especially if followed by application error responses or process restarts (GitHub Advisory).

The primary remediation is to upgrade Pillow to version 13.0.0 or later, which adds an explicit validation check rejecting TIFF images where the unpacker's row byte size exceeds libtiff's decoded row byte size (Pillow Release, Pillow Commit). As a workaround prior to upgrading, restrict TIFF file processing to trusted sources only and implement input validation to reject malformed or suspicious tiled-TIFF structures before they reach Pillow. Applications that do not need to process tiled TIFFs can consider filtering or rejecting such files at the ingestion layer.

Red Hat has tracked this vulnerability via Bugzilla (bug #2555857) and published a CVE advisory page, indicating it is being assessed for impact on Red Hat products (Red Hat CVE). The Pillow maintainers published a detailed GitHub Security Advisory (GHSA-462x-pgg6-55fp) with a thorough technical breakdown and embedded PoC, reflecting the project's proactive security disclosure practices. No significant broader media coverage or notable social media discussion has been identified at this time.