PT-2026-120317

============================================================================ TiffDecode returns uninitialized memory as pixels for short JPEG strips Location: src/libImaging/TiffDecode.c:554 in decodeStrip Commit: a707c6b21c313880d0771e54965d142dd42358b6...

PT-2026-117684

Name of the Vulnerable Software and Affected Versions Pillow versions 5.3.0 through 12.11.0 Description Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. This occurs because the decodeStrip and decodeTile buffers may...