CVE-2026-128066

Pillow is a Python imaging library. From 1.0 through 12.3.0, ImageFileDirectoryv2.load in src/PIL/TiffImagePlugin.py retains a separate bytes object for each out-of-line IFD tag value without limiting the total data read or preventing distinct tags from referencing the same file region. A small...

CVE-2026-128066

The Pillow Python imaging library (versions 1.0 through 12.3.0) is vulnerable to a Memory Denial of Service (DoS) in the ImageFileDirectory_v2.load() function within src/PIL/TiffImagePlugin.py. The root cause is that the library retains a separate bytes object for each out-of-line IFD tag value w...