CVE-2026-112902

Pillow is a Python imaging library. In versions through 12.3.0, the libtiff TIFF encoder can pass arguments to  TIFFSetField()  that do not match libtiff’s definition of the corresponding tag. When an application saves attacker-controlled image metadata through this encoder, crafted tag values can cause invalid memory reads, copying process memory into the encoded output or crashing the process. Applications that return the encoded output to an attacker can disclose that memory. The issue is reachable when re-saving compressed TIFF images and through certain conversions that preserve EXIF metadata into compressed TIFF output. This vulnerability is fixed in version 13.0.0.

• CWE-686

• https://github.com/python-pillow/Pillow/commit/570df030c0d30c2bf5336b2ab59f3902d8ab0b6d
• https://github.com/python-pillow/Pillow/pull/10227
• https://github.com/python-pillow/Pillow/releases/tag/13.0.0
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-xvh5-g6gv-559v

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-112898Pillow is a Python imaging library. From 9.1.0 until 13.0.0,…5.3
• CVE-2026-112899Pillow is a Python imaging library. In versions 2.3.0 throug…6.3
• CVE-2026-1129A vulnerability was detected in Yonyou KSOA 9.0. This vulner…9.8
• CVE-2026-11290Integer overflow in WebView in Google Chrome on Android prio…5
• CVE-2026-112900Pillow is a Python imaging library. From 2.6.0 until 13.0.0,…9.8
• CVE-2026-112901Pillow is a Python imaging library. Prior to 13.0.0, Pillow'…7.5
• CVE-2026-112904Vvveb is a powerful and easy to use CMS with page builder to…8.7
• CVE-2026-112905Vvveb is a powerful and easy to use CMS with page builder to…9
• CVE-2026-112906filelock is a platform-independent file lock for Python. Fro…4.7
• CVE-2026-112909filelock is a platform-independent file lock for Python. Pri…6.1
• CVE-2026-11291Inappropriate implementation in Android Autofill in Google C…4.3
• CVE-2026-112911filelock is a platform-independent file lock for Python. Fro…6.3