Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112902— Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags

Quick assessment

Affected
python-pillow Pillow
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Pillow 是一个 Python 图像处理库。在 12.3.0 及更早版本中，其 libtiff TIFF 编码器可能向 传递与 libtiff 对应标签定义不匹配的参数。当应用程序通过该编码器保存由攻击者控制图像元数据时，精心构造的标签值可能导致无效内存读取、将进程内存复制到编码输出中，或导致进程崩溃。若应用程序将编码后的输出返回给攻击者，则可能泄露该内存。此漏洞在重新保存压缩 TIFF 图像时，或通过某些保留 EXIF 元数据并转换为压缩 TIFF 输出的转换过程中可被触发。该问题已在 13.0.0 版本中修

CVSS 8.3 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112902

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
Source: CVE Program / CVE List V5
Vulnerability Description
Pillow is a Python imaging library. In versions through 12.3.0, the libtiff TIFF encoder can pass arguments to  TIFFSetField()  that do not match libtiff’s definition of the corresponding tag. When an application saves attacker-controlled image metadata through this encoder, crafted tag values can cause invalid memory reads, copying process memory into the encoded output or crashing the process. Applications that return the encoded output to an attacker can disclose that memory. The issue is reachable when re-saving compressed TIFF images and through certain conversions that preserve EXIF metadata into compressed TIFF output. This vulnerability is fixed in version 13.0.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用不正确参数类型的函数调用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
python-pillow Pillow < 13.0.0 -

II. Public POCs for CVE-2026-112902

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112902

请登录查看更多情报信息。

Vendor Pages for CVE-2026-112902 (1)

Other References for CVE-2026-112902 (3)

IV. Related Vulnerabilities

Same product: Pillow
Same vendor: python-pillow
Same weakness: CWE-686