Pillow EUVD-2026-104645

Requires the victim application to open a crafted TIFF and actually load its pixels (e.g., load(), convert(), thumbnail, or save-to-other-format) using Pillow 8.1.0 through 12.x with libtiff-backed decoding. The malicious file must carry duplicated PhotometricInterpretation or BitsPerSample tags that Pillow and libtiff interpret differently, and must drive the tile decode path (_decodeTile) or the RGBA unpacker path - the strip path already validates that the input row fits inside libtiff's produced row and is NOT affected. Limiting factors: exploitation is confined to applications that process attacker-controlled TIFF data through the vulnerable code paths; impact is primarily a crash plus limited, non-deterministic adjacent heap disclosure into output pixels rather than code execution, and upgrading to 13.0.0 fully removes the condition.

This is a CWE-126 out-of-bounds (over-read) flaw in Pillow's TIFF tile and RGBA decode paths (8.1.0 up to, but not including, 13.0.0). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.8 and emphasizes VA:H (process crash / DoS) with only VC:L (limited heap-memory disclosure into output pixels) and VI:N. No EPSS score was provided and the input does not list KEV or POC status, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals are therefore driven almost entirely by the CVSS vector rather than by observed attacker activity. Note a tension between the vector and the mechanism: AV:N/PR:N/UI:N models the common server-side case where an application auto-ingests attacker-supplied images, but exploitation fundamentally requires the target application to open and load pixels from a crafted TIFF, so in interactive/desktop contexts there is an implicit user/application action that the vector does not capture. Realistically this is a moderate-priority issue: the availability impact (crash) is the most reliable outcome, while the heap-data disclosure is bounded (adjacent row data bleeding into output pixels) and the confidentiality value to an attacker is uncertain and non-deterministic. Given Pillow's very broad deployment, patching is worthwhile, but the absence of KEV/POC/EPSS signals argues against emergency treatment.

An attacker uploads a crafted TIFF with duplicated PhotometricInterpretation or BitsPerSample tags to a web service that uses Pillow to decode or thumbnail user images. When the service loads pixels via the tile or RGBA path, Pillow reads past the row libtiff actually produced, either crashing the worker (DoS) or embedding adjacent heap bytes into the returned/processed image. No public weaponized exploit is identified in the provided data, though the fix commit includes a regression test that constructs a triggering short-strip/short-tile TIFF.