BIT-PILLOW-2026-112396 Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in...

PT-2026-123468

Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in...

Pillow: Heap Use-after-free When Encoding TIFF To An In-memory Buffer

Summary Saving an image as TIFF to an in-memory buffer can trigger a heap use-after-free if libtiff rejects a tag at encode time. When "TIFFWriteScanline" fails, the encoder frees its output buffer but leaves the libtiff handle open. Later, when the encoder object is torn down, "TIFFClose" flushe...

EUVD-2026-104632

Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer...

Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

Summary Saving an image as TIFF to an in-memory buffer can trigger a heap use-after-free if libtiff rejects a tag at encode time. When TIFFWriteScanline fails, the encoder frees its output buffer but leaves the libtiff handle open. Later, when the encoder object is torn down, TIFFClose flushes...

SUSE CVE-2026-112396

Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in...

Linux Distros Unpatched Vulnerability : CVE-2026-112396

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memo...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free via ImagingLibTiffEncode in src/libImaging/TiffDecode.c when a libtiff encode error occurs. The cleanup logic in the error path frees or closes TIFF resources calling TIFFCleanup/TIFFClose or freeclientstate-data without...

PYSEC-2026-4328

Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in...

DEBIAN-CVE-2026-112396

Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in...

CVE-2026-112396

Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in...

PYSEC-2026-4328

Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in...

CVE-2026-112396 Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in...

CVE-2026-112396 Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in...

CVE-2026-112396

Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in...

CVE-2026-112396 Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in...

CVE-2026-112396

Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in...

CVE-2026-112396

The Python imaging library Pillow (versions 11.3.0 through 13.0.0 ) is vulnerable to a heap use-after-free flaw within the libtiff component. When an application saves attacker-influenced TIFF tags to a BytesIO buffer, libtiff may reject a tag during encoding in ImagingLibTiffEncode . The resulti...

Red Hat: CVE-2026-112396: pillow: pillow: arbitrary code execution via heap use-after-free during TIFF encoding

Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in...

PT-2026-117654

Name of the Vulnerable Software and Affected Versions Pillow versions 11.3.0 through 12.x Description A heap use-after-free occurs when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. This happens when an application saves attacker-influenced TIFF tags to BytesIO, causing...