Memory disclosure in Pillow libtiff TIFF encoder via crafted tags
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- Partial Red Hat: 1 fixed, 10 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Pillow before 13.0.0 on PyPI passes arguments to TIFFSetField() that do not match libtiff's definition of the corresponding tag, a type confusion weakness (CWE-686). When an application saves attacker-controlled image metadata through the libtiff TIFF encoder, crafted tag values cause invalid memory reads. An attacker who receives the encoded output can read copied process memory, and the process can crash. The issue is reachable when re-saving compressed TIFF images and through some conversions that keep EXIF metadata in compressed TIFF output.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Pillow is a Python imaging library. In versions through 12.3.0, the libtiff TIFF encoder can pass arguments to TIFFSetField() that do not match libtiff’s definition of the corresponding tag. When an application saves attacker-controlled image metadata through this encoder, crafted tag values can cause invalid memory reads, copying process memory into the encoded output or crashing the process. Applications that return the encoded output to an attacker can disclose that memory. The issue is reachable when re-saving compressed TIFF images and through certain conversions that preserve EXIF metadata into compressed TIFF output. This vulnerability is fixed in version 13.0.0.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| python-pillow | Pillow | before 13.0.0 | 13.0.0 | Patch available | CNA |
| — | Pillow (PyPI) | before 13.0.0 | 13.0.0 | Patch available | GHSA-xvh5-g6gv-559v |
- Pillow Vendorpython-pillow Affected before 13.0.0 Fixed in 13.0.0 Patch available CNA
- Pillow (PyPI) Vendor— Affected before 13.0.0 Fixed in 13.0.0 Patch available GHSA-xvh5-g6gv-559v
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* | — | — | python-pillow |
- cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* Versions — — ·python-pillow
Remediation
Upgrade Pillow to version 13.0.0, which fixes the flaw. Red Hat AI Inference Server 3.5 is fixed by RHSA-2026:94738, RHSA-2026:94721, RHSA-2026:94717, RHSA-2026:94715, RHSA-2026:94709 and RHSA-2026:94702. Red Hat lists no available plan for Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 7 and other products.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA Pillow (python-pillow) Fixed in 13.0.0
- Fix · GHSA-xvh5-g6gv-559v Pillow (PyPI) Fixed in 13.0.0 Advisory →
Red Hat 6 advisories
- RHSA-2026:94738 Released 2026-11-03 · Red Hat rating CriticalRed Hat AI Inference 3.5.3 (CUDA)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cuda-rhel9
- RHSA-2026:94721 Released 2026-11-03 · Red Hat rating CriticalRed Hat AI Inference Tech Preview 3.5.3 (Gaudi)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-gaudi-rhel9
- RHSA-2026:94717 Released 2026-11-03 · Red Hat rating CriticalRed Hat AI Inference 3.5.3 (Spyre)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-spyre-rhel9
Show 3 more Red Hat advisories
- RHSA-2026:94715 Released 2026-11-03 · Red Hat rating CriticalRed Hat AI Inference Model Optimization Tools 3.5.3 (CUDA)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/model-opt-cuda-rhel9
- RHSA-2026:94709 Released 2026-11-03 · Red Hat rating CriticalRed Hat AI Inference 3.5.3 (ROCm)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-rocm-rhel9
- RHSA-2026:94702 Released 2026-11-03 · Red Hat rating CriticalRed Hat AI Inference 3.5.3 (CPU)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cpu-rhel9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix yet |
| Lightspeed Core | Affected | No fix yet |
| OpenShift Lightspeed | Affected | No fix yet |
| Red Hat AI Inference Server | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat AI Inference Server 3.5 | Fixed | RHSA-2026:94702, RHSA-2026:94709, RHSA-2026:94715, RHSA-2026:94717, RHSA-2026:94721, RHSA-2026:94738 |
Not affected: 2 products
- Red Hat Enterprise Linux 8
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2026-11-05 Threatist record created from CVE-2026-112902
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-07 Priority changed: MEDIUM → LOW
References
Other 6
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-xvh5-g6gv-559v
- https://github.com/python-pillow/Pillow/pull/10227
- https://github.com/python-pillow/Pillow/commit/570df030c0d30c2bf5336b2ab59f3902d8ab0b6d
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0
- https://github.com/python-pillow/Pillow/commit/af56ace297b0991d02988fcc2ea933e4824b4fb3
- https://github.com/python-pillow/Pillow
More python-pillow vulnerabilities
- TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
- TI-2022-24108 An XML External Entity (XXE) issue was discovered in Python through 3.9.1. CVSS 3.1CRITICAL 9.8
- TI-2022-17508 The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and… CVSS 3.1CRITICAL 9.8
- TI-2021-02254 Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c… CVSS 3.1CRITICAL 9.8
- TI-2007-04413 Directory traversal vulnerability in the (1) extract and (2) extractall functions in the… CVSS 3.1CRITICAL 9.8
- TI-2026-76627 Out-of-bounds read in Pillow TIFF encoder ColorMap handling CVSS 4.0HIGH 8.8
Sources
- CVE-2026-112902 · CVE Program
- CVE-2026-112902 · NVD
- FIRST EPSS
- CVE-2026-112902 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences