Python Pillow CVE-2026-112393

Exploitation requires the application to SAVE a COMPRESSED TIFF (e.g. PackBits or LZW compression) through libtiff to a write target that lacks a usable fileno() - specifically an in-memory stream such as io.BytesIO rather than a filesystem path or real file descriptor. The attacker must control either an out-of-line TIFF tag value or a retained ICC profile so that libtiff seeks forward past the current buffer during directory writing, triggering the undersized reallocation in _tiffWriteProc. The separate stale-heap disclosure variant additionally requires compressed TIFF output larger than 64 KiB (producing unwritten alignment gaps) but needs no crafted tag. LIMITING FACTORS: file paths and targets backed by real file descriptors are explicitly unaffected; uncompressed saves fall outside the described path; and the CVSS AC:H/AT:P reflect that the precise seek-past-end timing and buffer layout must be met, raising the bar beyond a trivial trigger.

The input CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) yields a 9.2 (Critical) driven by full triad impact and unauthenticated network reachability, but two attenuating metrics are explicitly present: AC:H (high complexity) and AT:P (a specific attack requirement). This is consistent with the description, which conditions exploitation on a narrow, non-default code path - saving COMPRESSED TIFF through libtiff to an in-memory target lacking a usable fileno() (e.g. BytesIO), with attacker influence over an out-of-line TIFF tag or a retained ICC profile. There is no EPSS score, no CISA KEV listing, and no SSVC decision data in the input, so real-world exploitation probability cannot be quantified from the provided signals. No public exploit was identified; the GitHub 'source code evidence' is the vendor fix commit and its regression test, NOT weaponized exploit code, and must not be conflated with a POC or with active exploitation. Net assessment: the raw score overstates immediate priority. The RCE claim is itself hedged by the advisory ('may allow code execution'), and the more reliably reproducible outcome is a process crash (DoS) or stale-heap memory disclosure. This is a genuine, patch-worthy memory-safety flaw in a very widely used library, but the specific trigger conditions make it closer to a high-CVSS / moderate-real-risk issue absent evidence of exploitation. Verify applicability against your own code paths: environments that only save to real file descriptors/paths are unaffected.

A web service uses Pillow to re-encode user-supplied images to compressed TIFF in memory (BytesIO) - for example a thumbnail or format-conversion pipeline - and returns or stores the result. An attacker submits an image carrying a crafted out-of-line TIFF tag or an oversized retained ICC profile so that, when libtiff seeks forward while writing the directory, the _tiffWriteProc callback copies data beyond an allocation sized from the stale prior buffer length, corrupting the heap. No public exploit code exists; realistic outcomes range from a reliable process crash (DoS) and disclosure of stale heap bytes to, less reliably, code execution, and the high attack complexity (AC:H/AT:P) means the specific in-memory save path and tag layout must be met.