Tetrak
GitHub ↗
Security · Pillow

Pillow's 2- and 4-bit palette unpackers read past the buffer

Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size

Advisory
CVE-2026-112394
Library
Pillow, pillow on PyPI
Published
Severity
not scored upstream
Affected
< 12.3.0
Fixed in
12.3.0
Reaches you
by opening a file

What triggers it

Loading an image whose raw tile uses the P;2L or P;4L unpacker with a width that leaves the line size and the unpacker's stride disagreeing.

What sillybos does

Refused with a setting

sillybos refuses the triggering file when the policy says so (Policy(png_colour_types=frozenset({"greyscale", "rgb", "greyscale-alpha", "rgba"})); tiff_photometrics without palette for a TIFF); the default policy lets it through.

Which unpacker a tile uses is decided inside Pillow from the format's own header, but the carrier is a palette image at 2 or 4 bits, and the header check sees the colour type and the depth: a scans-only policy (png_colour_types without palette, tiff_photometrics without palette) refuses it before Pillow sees it. The default allows palette images, so the setting is what closes this.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Re-bucketed on 2026-11-03: the carrier is refused by the same setting as CVE-2025-64505.

Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:

How to protect yourself

In general. Upgrade to Pillow 12.3.0.

Specifically. A scanner never writes a palette image: refuse palette PNGs and TIFFs by policy where the source is scans; upgrade Pillow.

The general advice applies to every row here.

Sources