Saving a TIFF to memory overruns a heap buffer
Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO.
- Advisory
- CVE-2026-112393 (also GHSA-332p-7hrc-92wf)
- Library
- Pillow, pillow on PyPI
- Published
- Severity
- 9.2 out of 10, as published
- Affected
- >= 2.0.0, < 13.0.0
- Fixed in
- 13.0.0
- Reaches you
- on a save path
What triggers it
Saving any image as TIFF to an in-memory destination (io.BytesIO) rather than a file; the data written past the buffer is attacker-chosen when the image came from outside.
What sillybos does
Not reached by opening a file
Opening or reading a file never reaches this flaw, so a check before decoding has nothing to refuse. Listed so that nobody expects it to.
A save-path flaw. Nothing read from the incoming file's header decides it, so a check before decoding cannot reach it.
How to protect yourself
In general. Upgrade to Pillow 13.0.0. Until then, save TIFFs to a file on disk, not to memory.
Specifically. Not something a pre-decode check can prevent; listed so that nobody expects it to.
The general advice applies to every row here.
Sources
- https://github.com/advisories/GHSA-332p-7hrc-92wf
- The record entry, triaged 2026-11-01, last checked 2026-11-01