Key points
- CVE-2026-112393 affects Pillow versions 2.0.0 through 12.9.9.
- The flaw enables heap buffer overflow and stale-heap disclosure.
- Version 13.0.0 resolves the issue for all affected users.
A critical security flaw in the Python Pillow imaging library has been addressed in the latest release. Security teams must update to version 13.0.0 to mitigate a heap buffer overflow that could allow remote code execution.
What happened
The vulnerability, tracked as CVE-2026-112393, carries a CVSS score of 9.2, rated as critical by the National Vulnerability Database. It stems from a heap buffer overflow and stale-heap disclosure within the _tiffWriteProc function. This issue arises when saving compressed TIFF data through libtiff to a target lacking a usable file descriptor, such as BytesIO.
The root cause involves incorrect allocation sizing during the write process. The callback calculates buffer size based on the prior buffer size rather than the current write position. This discrepancy allows an attacker-controlled out-of-line TIFF tag or a retained ICC profile to be copied beyond the allocated memory after libtiff seeks forward.
According to the NVD record, this overflow can crash the affected process and may permit arbitrary code execution. Independently, unwritten alignment gaps in compressed TIFF output larger than 64 KiB can disclose stale heap bytes. This disclosure occurs without requiring a crafted tag, expanding the potential attack surface for memory corruption scenarios.
Why it matters
The vulnerability affects a wide range of software relying on Pillow for image processing. Any Python application using Pillow version 2.0.0 or later, but earlier than 13.0.0, is potentially exposed. This includes web applications that process user-uploaded images, internal tools handling document conversion, and automated image manipulation scripts.
Systems using real file descriptors for file paths are unaffected by this specific flaw. The issue is specific to in-memory targets like BytesIO. However, many modern applications utilise in-memory streams for performance and flexibility, making this a significant risk for contemporary Python-based services that handle TIFF data.
What happens next
- Verify current Pillow versions across all development and production environments.
- Plan an upgrade to version 13.0.0 to eliminate the heap overflow risk.
- Review image processing pipelines for use of BytesIO with TIFF data.
- Monitor application logs for unexpected crashes related to TIFF handling.
Patch priority
Security operations teams should prioritise systems that accept untrusted TIFF files from external sources. Applications that process user uploads or integrate with third-party image services face the highest exposure. These environments require immediate attention to prevent potential remote code execution.
Internal tools that handle only trusted, locally generated images present a lower risk profile. These systems can be updated in subsequent maintenance windows. Regardless of risk level, all instances should be patched. Test the update in a non-production environment first to ensure compatibility with existing image processing workflows before rolling out broadly.
Background: Remote code execution vulnerabilities
Remote code execution often occurs because developers trust user input without validation, fail to restrict file permissions, or neglect to update dependencies. Fix these errors by enforcing strict input sanitisation, applying least-privilege principles, and integrating automated security checks into your secure software development lifecycle to prevent arbitrary command execution.
Read the full guide: Seven Configuration Mistakes That Allow Remote Code Execution
What to do and how to stay safe: Pillow
- Audit your Python dependencies to identify any use of Pillow versions prior to 13.0.0.
- Restrict input formats to exclude TIFF files if your application does not strictly require them.
- Implement strict validation for image metadata and file sizes before processing.
- Monitor for crashes or unusual memory usage in services handling compressed TIFF data.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Pillow are affected by CVE-2026-112393?
All versions from 2.0.0 up to, but not including, 13.0.0 are affected.
Is there a fix available for this vulnerability?
Yes, the issue is fixed in version 13.0.0 of the Pillow library.
Does this vulnerability affect files saved to disk?
No, file paths and targets with real file descriptors are unaffected by this issue.
