EUVD-2026-104659
GHSA-q45j-58j2-45rg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUpload crafted JPEG/Group4-compressed TIFF
-
Exploitlibtiff short-decodes fewer rows than declared
-
ExecutionPillow returns unwritten buffer tail as pixels
-
ImpactAttacker reads stale heap contents from output image
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization
|
| Exploitation Conditions | Exploitation requires (1) the TIFF to use JPEG compression (COMPRESSION=7) or Group 4 fax compression where libtiff performs a 'short decode' - the encoded strip/tile contains fewer rows than RowsPerStrip or TileLength declares - so the buffer tail is left uninitialized; and (2) the consuming application must load the attacker-supplied TIFF and then return or re-encode its pixel data back to the attacker, since that output channel is how the stale heap bytes are disclosed. Affected versions are Pillow 5.3.0 through 12.x for the tile path and 6.0.0 through 12.x for the strip path (fixed in 13.0.0). The key limiting factor is the output-exposure requirement: an application that decodes but never returns or re-serializes the pixels does not leak data; the disclosed bytes are also bounded to the unwritten buffer tail and are not attacker-positioned. |
| Impact | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) scores 8.7 (High) and describes a remote, low-complexity, unauthenticated issue with no user interaction and a confidentiality-only impact - there is no integrity or availability effect, and CWE-908 plus the description ('without memory corruption or a process crash') confirm this is an uninitialized-memory disclosure, not code execution. No EPSS score, KEV listing, or weaponized exploit was supplied in the input, so this is NOT confirmed as actively exploited; it is a high-CVSS confidentiality bug whose real-world priority hinges on an exploitability precondition the CVSS vector does not capture: the target application must return or re-encode the decoded pixels back to the attacker. The vendor rated confidentiality High (VC:H), but the leak is bounded to the unwritten tail of a decode buffer and its contents are not attacker-controlled, so practical impact is probabilistic heap disclosure rather than targeted secret theft - treat VC:H as an upper bound. Note the input Tag 'Buffer Overflow' is inconsistent with CWE-908 and the description and should be disregarded. |
| Exploit ScenarioDerived | An attacker uploads a crafted JPEG-compressed or Group 4 fax TIFF to a service that uses Pillow to decode and then return or re-encode the image (e.g., an avatar/thumbnail generator or image-conversion API). libtiff decodes only the few rows actually present but reports success, so Pillow copies the uninitialized tail of the strip/tile buffer into the output, and the returned image reveals stale heap bytes. The advisory's commit includes a reproducing test case, but no public weaponized exploit was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Uninitialized heap memory disclosure in Pillow 5.3.0 through 12.x allows remote attackers to read stale process memory by supplying a crafted TIFF that uses JPEG (COMPRESSION=7) or Group 4 fax compression and triggers a libtiff 'short decode', after which the library converts rows from a buffer whose unwritten tail was never cleared. The tile decode path has been affected since 5.3.0 and the strip path since 6.0.0, and the impact is confidentiality-only (memory disclosure with no corruption, crash, or code execution) - an application is only exposed if it both decodes the attacker-supplied image and returns or re-encodes the resulting pixel data, since that output channel is the only way the stale bytes reach the attacker. No public exploit code or active exploitation is indicated in the available data, and the issue is fixed in Pillow 13.0.0.
RemediationAI
Vendor-released patch: upgrade to Pillow 13.0.0, which zeroes the unwritten tail of the strip/tile buffer before conversion (commit 1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce); the same commit can be backported to older pinned branches where a major version upgrade is not immediately possible. If upgrading is delayed, the decisive control is to break the disclosure channel rather than the decode: ensure the application does not return raw or re-encoded pixels derived from untrusted TIFFs to the requester (for example, strip image metadata, re-render through a fixed-format transcoder, or return only thumbnails generated from trusted pipelines), which eliminates the leak without removing TIFF support. Alternatively, restrict accepted input to non-TIFF formats or reject TIFFs whose Compression tag is 7 (JPEG) or 4 (Group 4 fax), or whose RowsPerStrip/TileLength implies more rows than the compressed byte count can plausibly contain, at the cost of losing legitimate JPEG-in-TIFF and fax imagery. Running image decoding in a short-lived worker process with a minimal heap footprint reduces the sensitivity of whatever stale bytes are exposed, but does not prevent the disclosure itself. Refer to https://github.com/python-pillow/Pillow/security/advisories/GHSA-q45j-58j2-45rg for the authoritative vendor guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pillow's libtiff-backed decoder in src/libImaging/TiffDecode.c maintains a heap buffer tracked by state->bytes. In _decodeTile and _decodeStrip the buffer is realloc'd to the size implied by TileLength or RowsPerStrip, then libtiff's TIFFReadEncodedTile/TIFFReadEncodedStrip is invoked. Certain codecs - notably JPEG and Group 4 fax - can report success while decoding fewer rows than the strip or tile declares (a 'short decode'). Pillow then converted the full expected row count, copying past the written region into uninitialized heap, which is CWE-908 (Use of Uninitialized Resource) rather than a bounds violation. The upstream fix (commit 1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce) reorders the code so state->bytes still reflects the previously allocated size at realloc time and then memsets the delta (tile_bytes_size - state->bytes, or strip_size - state->bytes) to zero before updating state->bytes, guaranteeing the tail is deterministic. A regression test (Tests/test_file_libtiff.py::test_jpeg_short_strip, parameterized for tiled and stripped layouts) builds a 256x256 image whose JPEG data contains only 8 rows and asserts that the rows beyond the decoded data read back as zero. The affected CPE is cpe:2.3:a:python-pillow:pillow across the version range; the flaw is in the C extension wrapper's buffer bookkeeping, not in libtiff itself, so other libtiff consumers are unaffected.
Know when Pillow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Remote crafted file processed without auth or interaction by image-handling services (AV:N/AC:L/PR:N/UI:N); confidentiality-only heap disclosure with no integrity or availability impact (C:H/I:N/A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the bytes written by libtiff, but Pillow converts the expected rows without clearing the unwritten tail. The tile path is affected from 5.3.0 and the strip path from 6.0.0. An attacker can supply a crafted TIFF to an application that loads and returns or re-encodes its pixels. This can disclose stale heap contents without memory corruption or a process crash. This issue is fixed in version 13.0.0.
Blast Radius
ecosystem impact- 25 pypi packages depend on pillow (25 direct, 0 indirect)
Ecosystem-wide dependent count for version 5.3.0.
Technical POC Analysis
CWE-908 (use of uninitialized resource), in Pillow's libtiff binding, not in libtiff itself.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity flaw in the Pillow image-processing library (versions 5.3.0 through 12.x) can leak residual process memory to anyone who supplies a specially crafted TIFF file; the disclosure is limited to confidentiality and requires the application to decode the image and then return or re-encode the resulting pixel data. Because Pillow is embedded in a wide range of internal services, upload pipelines, and reporting tools, any team that processes untrusted images is exposed, and leaked memory could contain credentials, tokens, or other sensitive data held by the same process. There is no public exploit code or confirmed active exploitation, and the vendor has addressed the issue in Pillow 13.0.0, so this is a manageable but time-bound upgrade priority rather than an emergency.
Apply vendor patch (upgrade to Pillow 13.0.0). Until upgraded, restrict or reject TIFF uploads using JPEG (COMPRESSION=7) or Group 4 fax compression, avoid returning or re-encoding decoded pixel data to untrusted requesters, run decoding services in isolated low-privilege containers with no access to secrets, and monitor for suspicious image-processing activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files. Rated
Denial of service in Python Pillow (versions 8.2.0 through 12.2.0) allows remote attackers to exhaust memory during JPEG
Out-of-bounds memory disclosure in Python Pillow before 12.3.0 lets an attacker who supplies a crafted McIdas AREA image
Heap out-of-bounds write in Python Pillow prior to 12.3.0 lets an attacker who controls the rank-filter size parameter c
Uncontrolled memory consumption in Python Pillow (PIL) versions 5.1.0 through 12.2.x allows a remote attacker to cause d
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb
Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands v
Pillow versions 11.0.0 through 12.x (fixed in 13.0.0) can reuse a stale native ImagingCore buffer when a multi-frame ima
Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters
An issue was discovered in Pillow before 8.1.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo
Exploit-DB