Key points
- Versions 5.3.0 through 12.9.9 of the Pillow library are affected by the memory disclosure flaw.
- The issue stems from uninitialized memory being returned when decoding specific TIFF formats.
- A fix is available in version 13.0.0, which clears the unwritten buffer tails.
Security researchers have identified a high severity vulnerability in the widely used Python Pillow imaging library. The flaw allows attackers to disclose stale heap contents by supplying crafted TIFF files to affected applications.
What happened
The National Vulnerability Database records CVE-2026-112897 with a CVSS score of 8.7. The weakness maps to CWE-908, which concerns the use of uninitialized memory. According to the advisory, Pillow versions from 5.3.0 up to but not including 13.0.0 are vulnerable. The library fails to clear buffer tails when libtiff performs short decodes on JPEG-compressed or Group 4 fax TIFF data.
The _decodeStrip and _decodeTile buffers can exceed the number of bytes written by libtiff. Pillow converts the expected rows without clearing the unwritten tail. The tile path has been affected since version 5.3.0. The strip path became vulnerable starting with version 6.0.0.
An attacker can supply a crafted TIFF to an application that loads and returns or re-encodes its pixels. This action discloses stale heap contents. The disclosure occurs without causing memory corruption or triggering a process crash. The issue is fixed in version 13.0.0.
Why it matters
Organisations relying on Pillow for image processing face exposure to data leakage. The vulnerability enables the extraction of sensitive information residing in heap memory. Because the flaw does not cause crashes, it may remain undetected during normal operations. Attackers can exploit this to gather intelligence from exposed memory regions.
The wide range of affected versions increases the attack surface. Many legacy systems still run older versions of the library. The lack of immediate system instability makes this a stealthy vector for data theft. Teams must verify their current Pillow version against the affected range.
What happens next
- Audit all Python applications to identify installed Pillow versions.
- Check whether the application processes untrusted TIFF files.
- Plan an upgrade to version 13.0.0 or later.
- Monitor logs for unusual image processing activity.
Patch priority
Teams should prioritise systems that accept untrusted image uploads from external users. Web applications and API endpoints handling user-generated content pose the highest risk. Internal tools processing static assets may be lower priority. Before applying updates, test the patched version in a staging environment to ensure compatibility. Back up configuration files and application data. Roll out the fix in phases to monitor for regressions. If immediate patching is not possible, restrict input to trusted sources only.
What to do and how to stay safe: Pillow
- Verify the current Pillow version in all production and development environments.
- Implement strict input validation to reject malformed or unexpected TIFF files.
- Isolate image processing services from sensitive data stores where possible.
- Monitor for unusual memory usage patterns in image handling services.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Pillow versions are affected by CVE-2026-112897?
Versions from 5.3.0 up to but not including 13.0.0 are affected.
What is the CVSS score for this vulnerability?
The National Vulnerability Database assigns a CVSS score of 8.7, rated as HIGH.
Is there a fix available for this issue?
Yes, the issue is fixed in version 13.0.0 of the Pillow library.
