Pillow CVE-2026-112902

Exploitation is confined to the TIFF encode/save path: the application must call Pillow to write a TIFF image where the TIFF tag values (e.g. dimension/strip/colormap-related tags in the ImageFileDirectory) are attacker-influenced and inconsistent with the actual image data, causing an out-of-bounds read. Limiting factors: this is NOT reachable by merely opening a malicious file - it requires that untrusted input controls or seeds the TIFF tags used during saving, so applications that only decode images, or that write TIFFs with fully library-controlled tags, are not exposed. Exploitation requires Pillow versions prior to 13.0.0.

No CVSS vector, EPSS score, KEV listing, or POC reference is provided in the input, so quantitative exploitation signals are entirely absent and the only authoritative source is the Pillow 13.0.0 release notes / oss-security advisory, which rank CVE-2026-112902 (GHSA-xvh5-g6gv-559v, 'TIFF encoder memory disclosure and crash from mismatched tag values') as High severity among a large batch of Pillow fixes. Qualitatively this is a dual-impact bug: an information-disclosure primitive (uninitialized/out-of-bounds heap bytes written into the encoded TIFF output) plus a denial-of-service (process crash). Crucially, this is in the TIFF ENCODER (save path), not the decoder, so it is NOT triggered merely by opening a malicious file - exploitation requires the application to write a TIFF whose tag values are attacker-influenced and mutually inconsistent, which materially narrows the attack surface compared to the decoder bugs in the same advisory. This should be treated as a 'patch in normal cycle' High rather than an emergency: there is no evidence of active exploitation (not in CISA KEV) and no public exploit is referenced, and the memory disclosure is of uncontrolled/limited heap content rather than a targeted secret read. Verify version applicability against your deployed Pillow build; the fix is in 13.0.0 (released 2026-10-16).

An application that re-encodes or exports user-supplied images to TIFF (for example an image-processing pipeline, thumbnail/converter service, or document workflow) carries over or accepts attacker-influenced TIFF tags whose declared values do not match the actual image data. When Pillow's TIFF encoder serializes the image, the mismatched tags cause it to read beyond the valid buffer, leaking adjacent heap memory into the saved file or crashing the process. No public exploit code is referenced in the provided data.