Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112897— Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips

Quick assessment

Affected
python-pillow Pillow
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Pillow 是一个 Python 图像处理库。在版本 5.3.0 至 13.0.0 期间，当 libtiff 对 JPEG 压缩或 Group 4 传真格式的 TIFF 数据进行短解码时，Pillow 可能将未初始化的内存作为像素数据返回。 和 缓冲区的大小可能大于 libtiff 实际写入的字节数，但 Pillow 在转换预期行时并未清除未写入的尾部数据。其中，tile 路径自 5.3.0 起受影响，strip 路径自 6.0.0 起受影响。攻击者可向加载并返回或重新编码其像素的应用程序提供特制的 TIFF 文

CVSS 8.7 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112897

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
Source: CVE Program / CVE List V5
Vulnerability Description
Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the bytes written by libtiff, but Pillow converts the expected rows without clearing the unwritten tail. The tile path is affected from 5.3.0 and the strip path from 6.0.0. An attacker can supply a crafted TIFF to an application that loads and returns or re-encodes its pixels. This can disclose stale heap contents without memory corruption or a process crash. This issue is fixed in version 13.0.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对未经初始化资源的使用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
python-pillow Pillow >= 5.3.0, < 13.0.0 -

II. Public POCs for CVE-2026-112897

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112897

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-112897 (1)

Vendor Advisories for CVE-2026-112897 (1)

Vendor Pages for CVE-2026-112897 (1)

Same Patch Batch · python-pillow · 2026-10-19 · 27 CVEs total

CVE-2026-112393 9.2 CRITICAL Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
CVE-2026-112403 9.2 CRITICAL Pillow: Heap buffer overflow in ImagingJpegDecode
CVE-2026-112900 9.2 CRITICAL Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
CVE-2026-112398 9.2 CRITICAL Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
CVE-2026-112896 8.8 HIGH Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
CVE-2026-112404 8.8 HIGH Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
CVE-2026-112895 8.7 HIGH Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for C
CVE-2026-112405 8.7 HIGH Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
CVE-2026-112892 8.7 HIGH Pillow: MSP RLE decoder expands a tiny file into unbounded memory
CVE-2026-112399 8.7 HIGH Pillow: APNG background disposal allocates full canvas before decompression bomb check
CVE-2026-112397 8.7 HIGH Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
CVE-2026-112402 8.7 HIGH Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
CVE-2026-112400 8.7 HIGH Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
CVE-2026-112894 8.7 HIGH Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
CVE-2026-112406 8.7 HIGH Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
CVE-2026-112893 8.2 HIGH Pillow: Invalid free in FreeType glyph rendering when a stroker is active
CVE-2026-112392 8.2 HIGH Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
CVE-2026-112390 8.2 HIGH Pillow: Infinite loop in MIC n_frames when the embedded TIFF
CVE-2026-112898 6.9 MEDIUM Pillow: Image.quantize() with empty palette leaks uninitialized stack memory
CVE-2026-112901 6.9 MEDIUM Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes

Showing top 20 of 27 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Pillow
Same vendor: python-pillow
Same weakness: CWE-908

V. Comments for CVE-2026-112897

No comments yet

Leave a comment