CVE-2026-112396: 
Python vulnerability analysis and mitigation

CVE-2026-112396 is a heap use-after-free vulnerability in Pillow, the Python imaging library, affecting versions 11.3.0 through 12.3.0 (fixed in 13.0.0). The flaw occurs when libtiff rejects a tag during TIFF encoding to an in-memory buffer (e.g., BytesIO): the error path frees the output buffer without closing the TIFF handle, and subsequent cleanup flushes through the write callback into freed memory. This can crash the process and may enable remote code execution. It carries a CVSS v3.1 base score of 5.9 (Medium), classified under CWE-416 (Use After Free) and CWE-825 (Expired Pointer Dereference) (GitHub Advisory, Red Hat CVE).

The root cause lies in ImagingLibTiffEncode in src/libImaging/TiffDecode.c: when TIFFWriteScanline fails (e.g., because libtiff rejects an invalid Predictor tag), the error path frees clientstate->data (the in-memory output buffer) but does not close or null out the TIFF handle (clientstate->tiff). During encoder teardown, ImagingLibTiffEncodeCleanup calls TIFFClose(tiff) because tiff is still set, which triggers a flush through _tiffWriteProc — writing into the already-freed buffer. The Predictor tag value 3 (floating-point predictor) on integer sample data is a convenient trigger, as libtiff will reject it and abort the write. The fix (commit dc95da2) restructures cleanup to call TIFFClose/TIFFCleanup before freeing clientstate->data, and removes premature free() calls from the encode error paths (GitHub Advisory, Fix Commit).

Successful exploitation causes a process crash (denial of service) and, depending on heap state, may enable memory corruption leading to arbitrary code execution. Any service that re-encodes attacker-influenced images to TIFF in memory — such as image thumbnailing, conversion pipelines, or web upload handlers — is at risk. There is no confidentiality or integrity impact per the CVSS scoring, but availability is fully compromised, and the potential for code execution introduces a broader risk to the hosting environment (GitHub Advisory).

A proof-of-concept is publicly documented in the GitHub Security Advisory, demonstrating that a minimal Python script using Image.save() with a crafted tiffinfo dictionary (Predictor tag set to 3) reliably triggers a segmentation fault or heap corruption. No exploit kits or in-the-wild exploitation have been reported as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires no authentication or user interaction but has high attack complexity due to heap layout dependencies (GitHub Advisory, Red Hat CVE).

1. Identify target: Find a web service or application that accepts image uploads and re-encodes them as TIFF to an in-memory buffer (e.g., using BytesIO) with Pillow versions 11.3.0–12.3.0.
2. Craft malicious input: Prepare an image (any mode, e.g., grayscale L) to be saved as TIFF with LZW compression and a crafted tiffinfo dictionary setting tag 317 (Predictor) to value 3 (floating-point predictor, invalid for integer data).
3. Trigger the vulnerability: Submit the crafted image to the target service, causing it to execute code equivalent to:

import io
from PIL import Image
im = Image.new("L", (64, 64))
buf = io.BytesIO()
im.save(buf, format="TIFF", compression="tiff_lzw", tiffinfo={317: 3})

4. Observe outcome: libtiff rejects the Predictor tag, TIFFWriteScanline fails, the encoder frees clientstate->data, and subsequent TIFFClose during cleanup writes into freed memory — resulting in a segfault, heap corruption error, or (under favorable heap conditions) controlled memory write enabling code execution.
5. Achieve objective: Depending on heap layout, the attacker may achieve denial of service (crash) or escalate to remote code execution within the process context of the image-processing service (GitHub Advisory).

• Logs: Application logs showing OSError: encoder error -2 when writing image file followed by unexpected process termination or crash reports when processing TIFF images.
• Process: Segmentation fault (SIGSEGV) or corrupted double-linked list abort signals from the Python process handling image encoding; AddressSanitizer reports of heap-use-after-free in _tiffWriteProc / ImagingLibTiffEncodeCleanup.
• File System: Core dump files generated by the image-processing service process after handling a TIFF save operation.
• Network: Repeated upload requests containing TIFF images or images with unusual tiffinfo metadata (particularly tag 317 with value 3) from the same source IP (GitHub Advisory).

Upgrade Pillow to version 13.0.0 or later, which contains the fix in commit dc95da2 that restructures the TIFF encoder cleanup to close the TIFF handle before freeing the output buffer. No configuration-based workaround is available; the only effective mitigation is upgrading. As an interim measure, applications can avoid saving TIFF images to in-memory buffers (BytesIO) with untrusted tiffinfo data, or validate/sanitize TIFF tag values (particularly tag 317/Predictor) before passing them to Pillow (Pillow 13.0.0 Release, Fix Commit).

The vulnerability was reported by security researcher MegaManSec and credited in the GitHub Security Advisory. The Pillow maintainers (radarhere, Andrew Murray, and others) addressed it promptly in the 13.0.0 release alongside numerous other security fixes. No significant broader media coverage or notable social media discussion has been identified beyond the standard advisory publication (GitHub Advisory, Pillow 13.0.0 Release).