Security fix · CVE-2026-112896
Pillow is a Python imaging library.
Published Oct 19, 2026 · catalog updated Oct 28, 2026 · Pillow is a Python
Last checked Oct 31, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-112896. EPSS is 0.47%. Act only if a listed version of Pillow is a Python is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Pillow is a Python).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- High8.8
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.47%
- Remediation
- Version ranges on file
- Affected products
- Bitnami pillow · PyPI pillow · pip Pillow
## Summary A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 (ColorMap) with **768 SHORT values**: three zero-filled planes of 256 entries each. No Python object is forged and no metadata is injected after loading. Pillow's TIFF encoder allocates **768 × 2 = 1536 bytes**, then passes three plane pointers separated by 256 SHORT entries to libtiff. With , libtiff instead expects **65536 SHORT values per plane** and attempts a **131072-byte read** from a plane pointer. Existing ASAN observations identify a heap-buffer-overflow READ crossing the 1536-byte allocation made in . The malformed ColorMap need not be a valid palette for this grayscale image. The issue is that accepted metadata is forwarded on save without reconciling the fixed plane extent with the effective sample depth. Opening/loading alone is not the demonstrated fault; the encoder path is required. ## Impact and prerequisites An application must accept the input, retain the relevant TIFF metadata, and invoke the libtiff-backed TIFF save path. The observed consequence is an out-of-bounds read and ASAN termination. Process-memory exposure during encoding is a potential consequence, **not demonstrated by extracting arbitrary heap contents in this report**. No arbitrary read primitive, full memory-disclosure chain, code execution, address-space bypass, or cross-process effect is claimed. The 131072-byte attempted copy is not the number of bytes proven disclosed. This report does not run a synthetic-canary serializer or collect an unsanitized encoded output. ## Tested environment and limits of the evidence The existing observations were recorded on August 30, 2026, with **CPython 3.11.8 on macOS ARM64**, using the unmodified official **Pillow 12.3.0** wheel and its bundled **libtiff 4.7.1**: - Wheel: - Whe
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- Bitnami pillow0 → 13.0.0
- PyPI pillow0 → 13.0.0
- pip Pillow<= 12.3.0
How to fix CVE-2026-112896
Upgrade
CVE-2026-112896 lists a fix boundary at 13.0.0. Compare the installed build with that boundary before you change production.
Version check
Affected <= 12.3.0
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-112896. EPSS is 0.47%. Act only if a listed version of Pillow is a Python is installed.
Which versions are affected?
Compare what you have installed with Pillow <= 12.3.0. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-125: Out-of-bounds Read. EPSS 0.47%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Technology hubs
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 19, 2026 · NIST NVD
Detected
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read. Th
Oct 20, 2026 · NIST NVD
Updated
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read. Th
Oct 20, 2026 · NIST NVD
Updated
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read. Th
Oct 20, 2026 · GitHub Advisory Database
Updated
## Summary A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 (ColorMap) with **768 SHORT values**: three zero-filled planes of 256 entries each. No Python object is forged and no metadata is i
Oct 26, 2026 · PyPA Advisory Database
Fix available
pillow fixed in 13.0.0
Oct 26, 2026 · PyPA Advisory Database
Fix available
pillow fixed in 13.0.0
Oct 26, 2026 · PyPA Advisory Database
Updated
## Summary A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 (ColorMap) with **768 SHORT values**: three zero-filled planes of 256 entries each. No Python object is forged and no metadata is i
Oct 28, 2026 · PyPA Advisory Database
Updated
## Summary A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 (ColorMap) with **768 SHORT values**: three zero-filled planes of 256 entries each. No Python object is forged and no metadata is i
Sources
- CVE.orgVulnerability recordCVE-2026-112896
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-112896
30-day exploitation probability 0.47%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-pchr-8j38-3x4p
GitHub Advisory Database record mirrored by OSV.
github.com - NIST NVDVulnerability recordCVE-2026-112896
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when th
nvd.nist.gov - OpenSSF OSV / OSV ScannerPackage advisoryBIT-pillow-2026-112896
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
osv.dev - PyPA Advisory DatabasePackage advisoryGHSA-pchr-8j38-3x4p
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
osv.dev - PyPA Advisory DatabasePackage advisoryPYSEC-2026-4334
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when th
osv.dev
References
Freshness
Last verified in this catalog Oct 31, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSOct 31, 2026
- GitHub Advisory DatabaseOct 29, 2026
- OpenSSF OSV / OSV ScannerOct 29, 2026
- PyPA Advisory DatabaseOct 28, 2026
- PyPA Advisory DatabaseOct 28, 2026
- CVE.orgOct 21, 2026
- NIST NVDOct 21, 2026