A malformed compressed TIFF leaks heap memory into its pixels
Out-of-bounds read in TiffDecode.c tile and RGBA paths copies heap memory into the returned image.
- Advisory
- CVE-2026-112404 (also GHSA-c6hw-5grf-ff96)
- Library
- Pillow, pillow on PyPI
- Published
- Severity
- 8.8 out of 10, as published
- Affected
- >= 8.1.0, < 13.0.0
- Fixed in
- 13.0.0
- Reaches you
- by opening a file
What triggers it
Opening and loading a malformed compressed TIFF; the returned pixels carry fragments of the process's memory, which a service that returns thumbnails hands back.
What sillybos does
Refused with a setting
sillybos refuses the triggering file when the policy says so (STRICT, or Policy(allow_tiled_tiff=False); the RGBA path is not covered); the default policy lets it through.
The tiled path is refused under the strict preset; the RGBA path is not something the header distinguishes, so this is only partly within reach.
Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:
How to protect yourself
In general. Upgrade to Pillow 13.0.0. Never return pixels decoded from an untrusted file without re-encoding them first.
Specifically. Refuse tiled TIFFs where scans are striped; keep the decoder current for the rest.
The general advice applies to every row here.
Sources
- https://github.com/advisories/GHSA-c6hw-5grf-ff96
- The record entry, triaged 2026-11-01, last checked 2026-11-01