CVE-2026-112902

A crafted TIFF file of a few hundred bytes makes Pillow copy an attacker-chosen amount of its own process memory into the TIFF it writes back out, or crash the process outright. The trigger is an ordinary "Image.open" followed by a bare "im.savefp, "TIFF"". The only precondition is that the...