https://tetrak.dev/security/Recent content in Imaging security watch on TetrakHugoen-gbhttps://tetrak.dev/security/protecting-yourself/Sun, 01 Nov 2026 00:00:00 +0000https://tetrak.dev/security/protecting-yourself/<p>Every row in the <a href="https://tetrak.dev/security/">watch</a> ends with advice specific to that flaw. This page is the advice that applies to all of them. It is written for someone who runs a pipeline rather than someone who writes decoders: the steps are things you can do this week.</p> <h2 id="upgrade-and-know-what-you-have">Upgrade, and know what you have</h2> <p>The fixed version is the first line of every row for a reason: a flaw with a fix is closed by installing the fix, and nothing below is as good. The part people miss is knowing what to upgrade. An image library is several libraries: Pillow carries libjpeg-turbo, libpng, libtiff, OpenJPEG and zlib inside its wheels, and a Docker image carries the operating system&rsquo;s copies of the same underneath. Pin exact versions in a lock file, scan the lock file <em>and</em> the built image for published flaws (Trivy does both, for free), and let a tool propose the updates so that you only have to read them.</p>https://tetrak.dev/security/cve-2026-112398/Fri, 23 Oct 2026 00:00:00 +0000https://tetrak.dev/security/cve-2026-112398/<p>Heap buffer overflow in FlashPix (FPX) JPEG-tile decoding leads to code execution.</p>https://tetrak.dev/security/pillow/Fri, 23 Oct 2026 00:00:00 +0000https://tetrak.dev/security/pillow/<p>The Python image library. Most Python programs that open a JPEG, PNG or TIFF do it with Pillow, Tetrak OCR included; it wraps libjpeg-turbo, libpng, libtiff and the others below</p>https://tetrak.dev/security/cve-2026-96636/Thu, 22 Oct 2026 00:00:00 +0000https://tetrak.dev/security/cve-2026-96636/<p>The decompression-bomb check runs only on the first frame; MpoImageFile.seek() and DcxImageFile.seek() do not repeat it.</p>https://tetrak.dev/security/cve-2026-96639/Thu, 22 Oct 2026 00:00:00 +0000https://tetrak.dev/security/cve-2026-96639/<p>Multi-frame loaders can reuse stale native image storage after a mode transition, giving out-of-bounds writes; command execution was demonstrated through the MPO path.</p>https://tetrak.dev/security/cve-2026-96643/Thu, 22 Oct 2026 00:00:00 +0000https://tetrak.dev/security/cve-2026-96643/<p>A PNG eXIf chunk full of repeated six-byte markers makes Exif.load() copy the buffer once per marker.</p>https://tetrak.dev/security/cve-2026-96637/Thu, 22 Oct 2026 00:00:00 +0000https://tetrak.dev/security/cve-2026-96637/<p>SpiderImagePlugin&rsquo;s seek() re-parses the header without the decompression-bomb check, so a file under 1 KB can trigger a multi-gigabyte allocation.</p>https://tetrak.dev/security/cve-2026-112901/Wed, 21 Oct 2026 00:00:00 +0000https://tetrak.dev/security/cve-2026-112901/<p>A regular expression in XbmImagePlugin takes about six minutes of CPU on a crafted 512-byte file before Image.open() gives up.</p>https://tetrak.dev/security/cve-2026-112390/Wed, 21 Oct 2026 00:00:00 +0000https://tetrak.dev/security/cve-2026-112390/<p>Infinite loop in MIC n_frames when the embedded TIFF has three or more directories; needs the optional olefile package.</p>https://tetrak.dev/security/cve-2026-112399/Wed, 21 Oct 2026 00:00:00 +0000https://tetrak.dev/security/cve-2026-112399/<p>APNG background disposal allocates the full canvas before the decompression-bomb check; a 126-byte file claiming 22,000 x 22,000 pixels costs about 1.9 GB.</p>https://tetrak.dev/security/cve-2026-112900/Wed, 21 Oct 2026 00:00:00 +0000https://tetrak.dev/security/cve-2026-112900/<p>Argument injection in the Ghostscript call, potentially leading to remote code execution.</p>https://tetrak.dev/security/cve-2026-112391/Wed, 21 Oct 2026 00:00:00 +0000https://tetrak.dev/security/cve-2026-112391/<p>PdfParser can recurse without limit in get_value() and linearize_page_tree().</p>https://tetrak.dev/security/cve-2026-112393/Wed, 21 Oct 2026 00:00:00 +0000https://tetrak.dev/security/cve-2026-112393/<p>Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO.</p>https://tetrak.dev/security/cve-2026-112403/Tue, 20 Oct 2026 00:00:00 +0000https://tetrak.dev/security/cve-2026-112403/<p>Heap buffer overflow in ImagingJpegDecode: a lossless (SOF3) frame ignores the requested scaling and writes full-width rows into a buffer sized for the scaled width.</p>https://tetrak.dev/security/cve-2026-112404/Tue, 20 Oct 2026 00:00:00 +0000https://tetrak.dev/security/cve-2026-112404/<p>Out-of-bounds read in TiffDecode.c tile and RGBA paths copies heap memory into the returned image.</p>https://tetrak.dev/security/cve-2026-112395/Tue, 20 Oct 2026 00:00:00 +0000https://tetrak.dev/security/cve-2026-112395/<p>The tiled-TIFF decoder reads past the tile buffer in copy4 when libtiff returns a tile smaller than the worst case.</p>https://tetrak.dev/security/cve-2026-12912/Mon, 29 Jun 2026 00:00:00 +0000https://tetrak.dev/security/cve-2026-12912/<p>Decoding a PixarLog image with the 8-bit ABGR output format and a specific stride leads to a heap-based buffer overflow.</p>https://tetrak.dev/security/libtiff/Mon, 29 Jun 2026 00:00:00 +0000https://tetrak.dev/security/libtiff/<p>The C library that reads and writes TIFF, the format most archival scans are kept in. Pillow, poppler, ImageMagick and nearly everything else decode TIFF through it</p>https://tetrak.dev/security/cve-2026-33636/Thu, 26 Mar 2026 00:00:00 +0000https://tetrak.dev/security/cve-2026-33636/<p>One of three libpng flaws in the paths that handle palette (indexed-colour) PNGs. The upstream record was not re-fetched when this entry was written; see notes.</p>https://tetrak.dev/security/libpng/Thu, 26 Mar 2026 00:00:00 +0000https://tetrak.dev/security/libpng/<p>The reference C library for PNG, used by Pillow, browsers and most image software</p>https://tetrak.dev/security/cve-2026-4775/Tue, 24 Mar 2026 00:00:00 +0000https://tetrak.dev/security/cve-2026-4775/<p>Signed integer overflow in putcontig8bitYCbCr44tile leads to an out-of-bounds heap write.</p>https://tetrak.dev/security/cve-2026-22695/Mon, 12 Jan 2026 00:00:00 +0000https://tetrak.dev/security/cve-2026-22695/<p>One of two libpng overflows on the Adam7-interlaced 16-bit path. The upstream record was not re-fetched when this entry was written; see notes.</p>https://tetrak.dev/security/cve-2025-66293/Wed, 03 Dec 2025 00:00:00 +0000https://tetrak.dev/security/cve-2025-66293/<p>One of three libpng flaws in the paths that handle palette (indexed-colour) PNGs. The upstream record was not re-fetched when this entry was written; see notes.</p>https://tetrak.dev/security/cve-2025-64720/Mon, 24 Nov 2025 00:00:00 +0000https://tetrak.dev/security/cve-2025-64720/<p>One of three libpng flaws in the paths that handle palette (indexed-colour) PNGs. The upstream record was not re-fetched when this entry was written; see notes.</p>https://tetrak.dev/security/cve-2025-65018/Mon, 24 Nov 2025 00:00:00 +0000https://tetrak.dev/security/cve-2025-65018/<p>One of two libpng overflows on the Adam7-interlaced 16-bit path. The upstream record was not re-fetched when this entry was written; see notes.</p>https://tetrak.dev/security/cve-2023-6277/Fri, 24 Nov 2023 00:00:00 +0000https://tetrak.dev/security/cve-2023-6277/<p>An out-of-memory flaw in libtiff: a crafted file passed to TIFFOpen() makes it allocate from a tag&rsquo;s declared size.</p>