BIT-PILLOW-2026-112395 Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-co...

Pillow Tiled-TIFF Decoder Reads Past Tile Buffer In Copy4 (Unpack.c:1290)

Summary Pillow's libImaging "decodeTile" decoder, used to decode tiled TIFF images, allocates a per-tile buffer using "reallocstate-buffer, TIFFTileSizetiff". After each "TIFFReadTile" it then iterates "tiley" from 0 up to "currenttilelength" and calls the configured row unpacker here "copy4" wit...

Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Summary Pillow's libImaging decodeTile decoder, used to decode tiled TIFF images, allocates a per-tile buffer using reallocstate-buffer, TIFFTileSizetiff. After each TIFFReadTile it then iterates tiley from 0 up to currenttilelength and calls the configured row unpacker here copy4 with the source...

GHSA-462X-PGG6-55FP Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Summary Pillow's libImaging decodeTile decoder, used to decode tiled TIFF images, allocates a per-tile buffer using reallocstate-buffer, TIFFTileSizetiff. After each TIFFReadTile it then iterates tiley from 0 up to currenttilelength and calls the configured row unpacker here copy4 with the source...