CVE-2026-112897 with a CVSS score of 8.7 is a high-severity use-of-uninitialized-resource vulnerability in Pillow’s TiffDecode component, where short JPEG strips or tiles can cause the decoder to return uninitialized memory as pixel data. The vulnerability occurs when crafted TIFF images contain JPEG or Group 4 fax data with fewer decoded rows than declared, leaving portions of the decoding buffer uninitialized. When applications process attacker-controlled images and expose thumbnails, previews, converted images, or other pixel-derived output, previously freed process memory may be disclosed, potentially exposing sensitive data, internal state, or confidential information. This flaw primarily affects confidentiality and may lead to data leakage, compliance concerns, and reduced trust in systems that process untrusted image files. The issue is fixed by initializing the strip and tile buffers before decoding.
We recommend you to update Pillow to version 13.0.0 or later.[/subscribe_to_unlock_form]
CVE-2026-112897 with a CVSS score of 8.7 is a high-severity use-of-uninitialized-resource vulnerability in Pillow’s TiffDecode component, where short JPEG strips or tiles can cause the decoder to return uninitialized memory as pixel data. The vulnerability occurs when crafted TIFF images contain JPEG or Group 4 fax data with fewer decoded rows than declared, leaving portions of the decoding buffer uninitialized. When applications process attacker-controlled images and expose thumbnails, previews, converted images, or other pixel-derived output, previously freed process memory may be disclosed, potentially exposing sensitive data, internal state, or confidential information. This flaw primarily affects confidentiality and may lead to data leakage, compliance concerns, and reduced trust in systems that process untrusted image files. The issue is fixed by initializing the strip and tile buffers before decoding.
We recommend you to update Pillow to version 13.0.0 or later.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]