EUVD-2026-104658
GHSA-pchr-8j38-3x4p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUpload crafted TIFF to application
-
DeliveryApplication re-encodes image via libtiff
-
ExploitEncoder reads past ColorMap buffer
-
ExecutionAdjacent heap bytes copied into output
-
ImpactDisclose heap memory or crash process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the application SAVE/re-encode an attacker-supplied TIFF using Pillow's libtiff encoder path (WRITE_LIBTIFF) - simply opening the image does not trigger the bug. The malicious TIFF must retain a ColorMap whose length does not equal (1 << BitsPerSample) * 3 (e.g., a 16-bit 'I;16' image carrying an undersized ColorMap), which the encoder reuses on save. Limiting factors: the vulnerable code path is the TIFF re-encode/save operation, not decoding; it depends on libtiff-backed encoding being used; and the disclosure is limited to heap bytes adjacent to the ColorMap buffer (opportunistic, non-targeted). No authentication is required per the CVSS PR:N metric, so unauthenticated attackers can supply the input. |
| Impact | The supplied CVSS 4.0 base score is 8.8 (High), driven mainly by VA:H (process crash) and the network-reachable, unauthenticated, no-interaction vector (AV:N/AC:L/AT:N/PR:N/UI:N); confidentiality impact is only Low (VC:L), reflecting an uncontrolled heap-memory leak rather than targeted data theft, and there is no integrity impact (VI:N). This is CWE-125 (out-of-bounds read), an information-disclosure/DoS issue - NOT remote code execution - so the real-world severity is lower than the 8.8 headline suggests. No EPSS score, no CISA KEV listing, and no public exploit code were provided - only the vendor fix commit - so there is no public exploit identified at time of analysis. The AV:N rating is realistic ONLY for the specific class of applications that automatically re-encode/save attacker-supplied TIFFs with libtiff; the flaw is not triggered merely by opening an image, which meaningfully narrows the exposed population. Net: a genuine but conditional priority for services that accept and re-encode user TIFFs (patch promptly), but not a drop-everything internet-wide threat absent EPSS/KEV signals. |
| Exploit ScenarioDerived | An image-processing service accepts user TIFF uploads, opens them with Pillow, and then re-encodes or converts them (e.g., thumbnailing) via the libtiff path. An attacker uploads a small, valid-looking TIFF that retains a crafted ColorMap whose size is inconsistent with BitsPerSample; on save the encoder reads past the ColorMap buffer, leaking adjacent heap bytes into the output image or crashing the worker process. No public exploit code was identified - only the upstream fix commit is available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Out-of-bounds read in Pillow's TIFF encoder before 13.0.0 allows unauthenticated remote attackers to leak heap memory or cause a denial of service (process crash) when an application saves or re-encodes a malicious TIFF using the libtiff encoder. Exploitation requires the target to re-encode the attacker-supplied image-simply opening it does not trigger the bug-and the leak is limited to adjacent heap bytes rather than targeted data. No public exploit has been identified at time of analysis, and the vendor has released Pillow 13.0.0 to fix the issue.
RemediationAI
Vendor-released patch: 13.0.0. Upgrade to Pillow 13.0.0 or later, which enforces that the ColorMap length equals (1 << BitsPerSample) * 3 and replaces the fixed 8-bit stride with a dynamic stride; see the vendor advisory at https://github.com/python-pillow/Pillow/security/advisories/GHSA-pchr-8j38-3x4p and release notes at https://github.com/python-pillow/Pillow/releases/tag/13.0.0. If immediate upgrade is not possible, avoid re-encoding untrusted TIFF images with Pillow's libtiff encoder (set TiffImagePlugin.WRITE_LIBTIFF to False or isolate TIFF conversion in a separate low-privilege process), strip or reject incoming TIFF ColorMap tags whose length is not 3 * 2^BitsPerSample before saving, and run TIFF re-encoding in a sandboxed, memory-limited environment to contain crashes and heap disclosures. These workarounds trade performance, output compatibility, and image fidelity for reduced exposure, but they do not eliminate the underlying read and should be considered temporary.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-125 out-of-bounds read in Pillow's TIFF encoding path, specifically when the libtiff-backed encoder is used. In TIFF, the ColorMap tag stores palette entries and must contain exactly 3 * (1 << BitsPerSample) values; for an 8-bit image that is 768 entries, while a 16-bit image requires 196608 entries. Pillow retains TIFF metadata when opening an image, so a crafted TIFF can carry an undersized ColorMap whose length does not match its BitsPerSample. During a subsequent save/re-encode, the vulnerable encoder reused that retained ColorMap and previously assumed an 8-bit palette with a hardcoded stride of 256 and a fixed 768-entry length check, causing it to read past the ColorMap buffer when the sample depth was higher. The upstream fix adds a _validate_tags check that requires len(ColorMap) == (1 << BitsPerSample) * 3 and changes the C encoder to derive stride dynamically from BitsPerSample, raising a ValueError on mismatch (for example, Requiring 196608 items for Colormap for a 16-bit image).
Know when Pillow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Unauthenticated remote attacker supplies a TIFF the application re-encodes; OOB read leaks limited adjacent heap memory (C:L) and can crash the process (A:H), with no integrity impact and no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read. This can disclose heap memory in the output or crash the process. This issue is fixed in version 13.0.0.
Blast Radius
ecosystem impact- 89,616 pypi packages depend on pillow (20,283 direct, 70,825 indirect)
Ecosystem-wide dependent count for version 13.0.0.
Technical POC Analysis
CWE-125, out-of-bounds read in Pillow's TIFF encoder.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Pillow, the Python imaging library embedded in many of our internal and customer-facing upload, thumbnail, and document-processing pipelines, contains a high-severity memory-handling flaw in its TIFF encoder that can crash processing services and expose small fragments of adjacent process memory. Any service that accepts user-supplied images and re-saves or converts them to TIFF is in scope, meaning availability of image workflows and potential cross-request data exposure are the core leadership concerns. A vendor fix already exists, so the residual risk is driven primarily by how quickly engineering teams can inventory and upgrade affected deployments.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files. Rated
Denial of service in Python Pillow (versions 8.2.0 through 12.2.0) allows remote attackers to exhaust memory during JPEG
Out-of-bounds memory disclosure in Python Pillow before 12.3.0 lets an attacker who supplies a crafted McIdas AREA image
Heap out-of-bounds write in Python Pillow prior to 12.3.0 lets an attacker who controls the rank-filter size parameter c
Uncontrolled memory consumption in Python Pillow (PIL) versions 5.1.0 through 12.2.x allows a remote attacker to cause d
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb
Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands v
Pillow versions 11.0.0 through 12.x (fixed in 13.0.0) can reuse a stale native ImagingCore buffer when a multi-frame ima
Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters
An issue was discovered in Pillow before 8.1.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo
Exploit-DB