VDB
CVE-2026-112396
CVE-2026-112396
PUBLISHED
CVSS 5.9 MEDIUM
Reported by GitHub_M · Published October 19, 2026
Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in ImagingLibTiffEncode; the error path then frees the output buffer without closing or clearing the TIFF handle, and later cleanup flushes through the write callback into freed memory, which can crash the process and may enable code execution. This issue is fixed in version 13.0.0.
Risk Scores
CVSS 3.1
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| python-pillow | Pillow | >= 11.3.0, < 13.0.0 |
| chainguard | superset-fips-6.1 | 0 |
| python-pillow | Pillow | 11.3.0 |
| chainguard | nemo-rl-cuda-13.0 | 0 |
| chainguard | apache-beam-python-3.12-sdk | 0 |
| PyPI | Pillow | 11.3.0 |
| chainguard | py3-pillow | 0 |
| chainguard | openstack-horizon-2025.2 | 0 |
| wolfi | py3-pillow | 0 |
| chainguard | open-webui | 0 |
| chainguard | py3-pytorch-cuda-13.0 | 0 |
| wolfi | open-webui | 0 |
| chainguard | nemo-gym | 0 |
Timeline
- Oct 19, 2026 CVE Published
- Oct 20, 2026 EPSS Score
- Oct 20, 2026 Coalition ESS Score
- Oct 21, 2026 CVE Updated
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 27, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
- Oct 30, 2026 Security Advisory
- Oct 31, 2026 EPSS Score
References
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-4rr5-89j8-mwwm x_refsource_CONFIRM
- https://github.com/python-pillow/Pillow/commit/dc95da20207827a062cfbf551ee9f6031465a8bb x_refsource_MISC
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-112396 advisory
- https://github.com/advisories/GHSA-4rr5-89j8-mwwm advisory