Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read. This can disclose heap memory in the output or crash the process. This issue is fixed in version 13.0.0.
References
| Link | Resource |
|---|---|
| https://github.com/python-pillow/Pillow/commit/d03dc3c587a9b0bdc9e4304d70d59a635a87b742 | Patch |
| https://github.com/python-pillow/Pillow/releases/tag/13.0.0 | Release Notes |
| https://github.com/python-pillow/Pillow/security/advisories/GHSA-pchr-8j38-3x4p | Exploit Vendor Advisory |
| https://github.com/python-pillow/Pillow/security/advisories/GHSA-pchr-8j38-3x4p | Exploit Vendor Advisory |
Configurations
History
27 Oct 2026, 14:55
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Python
Python pillow |
|
| References | () https://github.com/python-pillow/Pillow/commit/d03dc3c587a9b0bdc9e4304d70d59a635a87b742 - Patch | |
| References | () https://github.com/python-pillow/Pillow/releases/tag/13.0.0 - Release Notes | |
| References | () https://github.com/python-pillow/Pillow/security/advisories/GHSA-pchr-8j38-3x4p - Exploit, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.1 |
| CPE | cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* |
20 Oct 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/python-pillow/Pillow/security/advisories/GHSA-pchr-8j38-3x4p - |
19 Oct 2026, 22:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-19 22:17
Updated : 2026-10-27 14:55
NVD link : CVE-2026-112896
Mitre link : CVE-2026-112896
CVE.ORG link : CVE-2026-112896
JSON object : View
Products Affected
python
- pillow
CWE
CWE-125
Out-of-bounds Read