CVE-2026-128066

Pillow is a Python imaging library. From 1.0 through 12.3.0, ImageFileDirectoryv2.load in src/PIL/TiffImagePlugin.py retains a separate bytes object for each out-of-line IFD tag value without limiting the total data read or preventing distinct tags from referencing the same file region. A small...

CVE-2026-128066

The Pillow Python imaging library (versions 1.0 through 12.3.0) is vulnerable to a Memory Denial of Service (DoS) in the ImageFileDirectory_v2.load() function within src/PIL/TiffImagePlugin.py. The root cause is that the library retains a separate bytes object for each out-of-line IFD tag value w...

PT-2026-146092

Name of the Vulnerable Software and Affected Versions Pillow versions 1.0 through 12.3.0 Description In the Python imaging library, the ImageFileDirectory v2.load function in src/PIL/TiffImagePlugin.py retains a separate bytes object for each out-of-line IFD Image File Directory tag value. This...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the TIFF image encoder in TiffImagePlugin.py and src/encode.c, where the ColorMap length is not validated against the BitsPerSample tag value. Prior to the fix, the encoder hardcoded a requirement of 768 entries...

GHSA-Q4MP-JVH2-76FJ Pillow subject to DoS via SAMPLESPERPIXEL tag

Pillow starting with 9.2.0 and prior to 9.3.0 allows denial of service via SAMPLESPERPIXEL. A large value in the SAMPLESPERPIXEL tag could lead to a memory and runtime DOS in TiffImagePlugin.py when setting up the context for image decoding. This issue has been patched in version 9.3.0...