Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

Summary Saving an image as TIFF to an in-memory buffer can trigger a heap use-after-free if libtiff rejects a tag at encode time. When TIFFWriteScanline fails, the encoder frees its output buffer but leaves the libtiff handle open. Later, when the encoder object is torn down, TIFFClose flushes...

GHSA-4RR5-89J8-MWWM Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

Summary Saving an image as TIFF to an in-memory buffer can trigger a heap use-after-free if libtiff rejects a tag at encode time. When TIFFWriteScanline fails, the encoder frees its output buffer but leaves the libtiff handle open. Later, when the encoder object is torn down, TIFFClose flushes...

CVE-2026-53877

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. django.contrib.gis.gdal.GDALRaster over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the vsibuffer...

Projected File System Privilege Escalation

The vulnerability of the Projected File System ProjFS in the Windows operating system relates to operations that go beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to increase their privileges...

Microsoft Windows CredSSP Privilege Escalation

The vulnerability of the Credential Security Support Provider CredSSP protocol implementation in the Microsoft Windows operating system lies in the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow attackers to enhance their privileges...

Citrix NetScaler Buffer Overflow DoS

The vulnerability of the Citrix NetScaler Application Delivery Controller previously Citrix ADC and the Citrix NetScaler Gateway previously Citrix Gateway access control system lies in the escape of operations beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to cau...

Azure Storage Mover Buffer Overflow RCE

The vulnerability of the Azure Storage Mover service is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Oracle MySQL Cluster Full Control

Vulnerability of the Cluster component: The general database management system for Oracle MySQL Cluster is vulnerable when operations are performed outside the buffer in memory. Exploiting this vulnerability can allow an attacker to gain full control over the application through various network...

Squid proxy server Buffer Overflow Information Disclosure

The vulnerability of the Squid proxy server is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to protected information by sending specially crafted requests...

389 Directory Server Buffer Overflow DoS

The vulnerability of the enterprise-level catalog service 389 Directory Server lies in the fact that the operation is performed outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures...

yodl queue_push Use-After-Free

The vulnerability of the queuepush function in the yodl package occurs due to the operation being performed outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and accessibility of data...