Tetrak
GitHub ↗
Security · Pillow

Crafted TIFF tags make Pillow's libtiff encoder copy process memory into the output

Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags

Advisory
CVE-2026-112902
Library
Pillow, pillow on PyPI
Published
Severity
not scored upstream
Affected
< 12.3.0
Fixed in
12.3.0
Reaches you
on a save path

What triggers it

Opening a crafted TIFF and saving it back as TIFF with its tags.

What sillybos does

Refused with a setting

sillybos refuses the triggering file when the policy says so (Policy(tiff_tags={"standard", "metadata"})); the default policy lets it through.

The crafted tags (DNGPrivateData and ActiveArea, private and DNG tags a scan never carries) ride from the opened file's tag table into a bare save, through libtiff whenever the file is compressed, with no option from the program. The tags are in the directory the reader walks, and every tag is sorted into standard, metadata or private: a policy allowing standard and metadata tags refuses the file before Pillow sees it (tiff_tags). The default allows private tags, since a vendor's own tag in a scanner's output is harmless on a read, so the setting is what closes this. Tetrak OCR copies each frame before saving, which drops the tag table, so it is not reached there.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Re-read on 2026-11-03 against the question of what rides from an opened file into a save: the file is the input. Bucket and finding confirmed by a person on 2026-11-03; waits for the policy on a TIFF's tags and its test before it can be promoted. The policy was built on 2026-11-03 (sillybos 4.2.0).

Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:

How to protect yourself

In general. Upgrade to Pillow 12.3.0.

Specifically. Allow standard and metadata tags only (tiff_tags) wherever a file from outside is saved back as TIFF with its tag table; upgrade to Pillow 12.3.0.

The general advice applies to every row here.

Sources