BIT-PILLOW-2026-112395 Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-co...

Pillow Tiled-TIFF Decoder Reads Past Tile Buffer In Copy4 (Unpack.c:1290)

Summary Pillow's libImaging "decodeTile" decoder, used to decode tiled TIFF images, allocates a per-tile buffer using "reallocstate-buffer, TIFFTileSizetiff". After each "TIFFReadTile" it then iterates "tiley" from 0 up to "currenttilelength" and calls the configured row unpacker here "copy4" wit...

SUSE CVE-2026-112395

Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-co...

GHSA-462X-PGG6-55FP Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Summary Pillow's libImaging decodeTile decoder, used to decode tiled TIFF images, allocates a per-tile buffer using reallocstate-buffer, TIFFTileSizetiff. After each TIFFReadTile it then iterates tiley from 0 up to currenttilelength and calls the configured row unpacker here copy4 with the source...

EUVD-2026-104606

Pillow tiled-TIFF decoder reads past tile buffer in copy4 Unpack.c:1290...

Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Summary Pillow's libImaging decodeTile decoder, used to decode tiled TIFF images, allocates a per-tile buffer using reallocstate-buffer, TIFFTileSizetiff. After each TIFFReadTile it then iterates tiley from 0 up to currenttilelength and calls the configured row unpacker here copy4 with the source...

Linux Distros Unpatched Vulnerability : CVE-2026-112395

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In...

CVE-2026-112395

A flaw was found in Pillow. Its tiled-TIFF image decoder does not properly restrict buffer boundaries when copying pixel data, leading to an out-of-bounds read. A remote attacker could exploit this vulnerability by providing a specially crafted tiled TIFF image to an application using the library...

DEBIAN-CVE-2026-112395

Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-co...

CVE-2026-112395

Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-co...

CVE-2026-112395

Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-co...

CVE-2026-112395

The Pillow Python imaging library (versions 8.2.0 through 13.0.0 ) contains a vulnerability in its tiled-TIFF decoder . The issue arises because libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, causing Pillow's _decodeTile stride-and-copy lo...

CVE-2026-112395 Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-co...

CVE-2026-112395 Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-co...

CVE-2026-112395

Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-co...

Red Hat: CVE-2026-112395: pillow: pillow: Information disclosure via crafted tiled TIFF image

Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-co...

PT-2026-117649

Name of the Vulnerable Software and Affected Versions Pillow versions 8.2.0 through 12.x.x Description The tiled-TIFF decoder in the libImaging module contains a memory corruption issue. When processing tiled TIFF images, the decodeTile function allocates a buffer based on the tile size reported ...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the DecodeTilesChunky process. An attacker can cause a process crash or potentially achieve arbitrary code execution by supplying a crafted tiled TIFF file with fax compression that triggers an out-of-bounds write...

EUVD-2026-93770

ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write...

ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write

Summary When decoding a tiled TIFF with fax compression T4/T6/MH, DecodeTilesChunky allocates each tile buffer from TileWidth ceilTileWidthbpp/8TileLength bytes but constructs the fax decompressor with frame.Width: TiffDecompressorsFactory ignores the isTiled/tileWidth/tileHeight parameters...