Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-copy loop walks beyond that allocation. An attacker can supply a crafted tiled TIFF to an application that loads it. This can expose adjacent heap data in pixels or crash the process. This issue is fixed in version 13.0.0.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/python-pillow/Pillow/commit/76869efdbbf2ad7dccd7536520fb61b7a00ab61e Patch
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-462x-pgg6-55fp Exploit, Vendor Advisory
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-462x-pgg6-55fp Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 7
- StatusAnalyzed → ModifiedNVD modified 2026-10-28 16:17
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-26 20:51
- StatusUndergoing Analysis → AnalyzedNVD modified 2026-10-26 20:51
- CVSS6.5 (v3.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) → 8.2 (v3.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)NVD modified 2026-10-26 20:51
- StatusPublished → Undergoing AnalysisNVD modified 2026-10-20 19:48
- StatusReceived → PublishedNVD modified 2026-10-19 20:59
- First seenCVSS 6.5NVD modified 2026-10-19 21:17
Affected (CPE criteria) 1
cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
References 4
- https://github.com/python-pillow/Pillow/commit/76869efdbbf2ad7dccd7536520fb61b7a00ab61e Patch
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0 Release Notes
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-462x-pgg6-55fp Exploit, Vendor Advisory
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-462x-pgg6-55fp Exploit, Vendor Advisory