Tetrak
GitHub ↗
Security · Pillow

Saving a TIFF with a retained ColorMap over-reads in Pillow's encoder

Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read

Advisory
CVE-2026-112896
Library
Pillow, pillow on PyPI
Published
Severity
not scored upstream
Affected
< 12.3.0
Fixed in
12.3.0
Reaches you
on a save path

What triggers it

Opening a 16-bit palette TIFF with a 768-entry ColorMap and saving it back as TIFF with its metadata.

What sillybos does

Refused by default

sillybos refuses the triggering file under its default policy, through the allow_inconsistent_tiff_tags check.

The ColorMap rides from the opened file's tag table into a save that keeps its metadata. The tag is in the directory the reader walks, and its 768 entries disagree with 16-bit samples, which need 196,608: the reader reports the contradiction, and a policy that refuses inconsistent tags refuses the file before Pillow sees it (allow_inconsistent_tiff_tags). The default refuses it since 5.0.0; before that the setting had to be chosen.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Re-read on 2026-11-03 against the question of what rides from an opened file into a save: the file is the input. Bucket and finding confirmed by a person on 2026-11-03; waits for the policy on a TIFF's tags and its test before it can be promoted. The policy was built on 2026-11-03 (sillybos 4.2.0). Refused by default from 5.0.0 (3 November 2026).

Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:

How to protect yourself

In general. Upgrade to Pillow 12.3.0.

Specifically. Keep allow_inconsistent_tiff_tags off, as it is by default; upgrade to Pillow 12.3.0.

The general advice applies to every row here.

Sources