Python Pillow EUVD-2026-104606

The target application must load and decode an attacker-supplied TIFF via Pillow (versions 8.2.0 through 12.x; fixed in 13.0.0), and the file must use the tiled-TIFF decode path handled by _decodeTile. The specific trigger is a TIFF where libtiff returns a tile allocation smaller than row_stride × tile_length - in practice produced by conflicting/duplicated tags (e.g. duplicated BitsPerSample or PhotometricInterpretation, or a multi-value PhotometricInterpretation) that make Pillow's chosen unpacker consume more bytes per row (4-byte RGBX/RGBA, 6-byte RGB;16N) than libtiff actually decoded. Limiting factors: exploitation requires the app to accept and process untrusted TIFF input, impact is bounded to adjacent-heap disclosure (C:L) or a process crash (A:L) with no write/integrity primitive, and upgrading to Pillow 13.0.0 fully remediates by rejecting such images with 'decoder error -2'.

This is a genuine but moderate-severity issue, best triaged as medium priority rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, base 6.5) indicates a network-reachable, low-complexity, unauthenticated flaw, but impact is deliberately scoped low: C:L reflects a partial heap information leak into returned pixels, I:N (no integrity impact - it is a read overflow, not a write primitive per CWE-122's heap classification; see confidence notes), and A:L reflects a possible process crash (DoS). No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and there is no evidence of active exploitation. The fix commit does publish crafted TIFF test vectors that deterministically trigger the condition, which materially lowers the barrier to building a reproducer. No SSVC decision data was supplied. Weighing these signals: this is a real, easily-triggered bug in a very widely used library, but its practical ceiling is heap data disclosure and DoS rather than code execution, so it should be patched promptly where untrusted TIFFs are processed but does not rise to drop-everything criticality.

An attacker uploads a crafted tiled TIFF (for example with duplicated BitsPerSample/PhotometricInterpretation tags so Pillow's unpacker reads more bytes per pixel than libtiff decoded) to a web service, thumbnailing pipeline, or document processor that opens images with Pillow. When the application calls Image.open().load(), the stride-and-copy loop in _decodeTile walks past the undersized tile allocation, copying adjacent heap bytes into the output pixels (information disclosure) or crashing the worker (DoS). Crafted trigger samples are publicly available in the official fix commit, lowering the bar for reproduction.