VDB
CVE-2026-112395
CVE-2026-112395
PUBLISHED
CVSS 6.5 MEDIUM
Reported by GitHub_M · Published October 19, 2026
Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-copy loop walks beyond that allocation. An attacker can supply a crafted tiled TIFF to an application that loads it. This can expose adjacent heap data in pixels or crash the process. This issue is fixed in version 13.0.0.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| python-pillow | Pillow | >= 8.2.0, < 13.0.0 |
| wolfi | superset-6.1 | 0 |
| chainguard | openstack-horizon-2026.1 | 0 |
| chainguard | nemo-gym | 0 |
| chainguard | tensorflow-cpu-jupyter | 0 |
| chainguard | open-webui | 0 |
| chainguard | kubeflow-pipelines-visualization-server | 0 |
| chainguard | nemo-rl-cuda-13.0 | 0 |
| chainguard | openstack-horizon-2025.2 | 0 |
| chainguard | label-studio | 0 |
| wolfi | kubeflow-pipelines-visualization-server | 0 |
| PyPI | Pillow | 8.2.0 |
| chainguard | jupyter-all-spark-notebook | 0 |
| wolfi | superset-6.0 | 0 |
| chainguard | apache-beam-python-3.11-sdk | 0 |
| wolfi | kserve | 0 |
| wolfi | open-webui | 0 |
| chainguard | py3-pillow | 0 |
| chainguard | openstack-horizon-2026.1-fips | 0 |
| chainguard | gftools | 0 |
…and 19 more
Timeline
- Oct 19, 2026 CVE Published
- Oct 20, 2026 EPSS Score
- Oct 22, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 27, 2026 EPSS Score
- Oct 28, 2026 CVE Updated
- Oct 29, 2026 EPSS Score
- Oct 30, 2026 Security Advisory
References
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-462x-pgg6-55fp x_refsource_CONFIRM
- https://github.com/python-pillow/Pillow/commit/76869efdbbf2ad7dccd7536520fb61b7a00ab61e x_refsource_MISC
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-112395 advisory
- https://github.com/advisories/GHSA-462x-pgg6-55fp advisory