CVE-2026-112404 with a CVSS score of 8.8 is a high-severity out-of-bounds read vulnerability in the Pillow image library, specifically in the TiffDecode.c tile and RGBA decoding paths. The flaw occurs when Pillow processes a maliciously crafted TIFF image, allowing an attacker to trigger an out-of-bounds read during tile or RGBA decoding. The CVSS vector indicates a network attack vector, low attack complexity, no required privileges, and no user interaction, meaning a remote attacker can exploit the issue by supplying a crafted image to an application that uses Pillow for image processing. The vulnerability leaks heap memory into pixel output, potentially exposing sensitive data retained in memory. In addition to confidentiality exposure, the CVSS impact metrics indicate high availability impact, so successful exploitation could also cause denial of service or disruption of image-processing services. The primary business impact is unauthorized disclosure of sensitive information and potential operational disruption for systems that rely on Pillow to decode TIFF images.
We recommend you to update Pillow to version 13.0.0.[/subscribe_to_unlock_form]
CVE-2026-112404 with a CVSS score of 8.8 is a high-severity out-of-bounds read vulnerability in the Pillow image library, specifically in the TiffDecode.c tile and RGBA decoding paths. The flaw occurs when Pillow processes a maliciously crafted TIFF image, allowing an attacker to trigger an out-of-bounds read during tile or RGBA decoding. The CVSS vector indicates a network attack vector, low attack complexity, no required privileges, and no user interaction, meaning a remote attacker can exploit the issue by supplying a crafted image to an application that uses Pillow for image processing. The vulnerability leaks heap memory into pixel output, potentially exposing sensitive data retained in memory. In addition to confidentiality exposure, the CVSS impact metrics indicate high availability impact, so successful exploitation could also cause denial of service or disruption of image-processing services. The primary business impact is unauthorized disclosure of sensitive information and potential operational disruption for systems that rely on Pillow to decode TIFF images.
We recommend you to update Pillow to version 13.0.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]