CVE-2026-128066

Pillow is a Python imaging library. From 1.0 through 12.3.0, ImageFileDirectory_v2.load() in src/PIL/TiffImagePlugin.py retains a separate bytes object for each out-of-line IFD tag value without limiting the total data read or preventing distinct tags from referencing the same file region. A small crafted TIFF or EXIF-bearing JPEG, PNG, WebP, or MPO can therefore cause memory use quadratic in the input size. TIFF and some JPEG paths trigger parsing during Image.open(), while other formats are exposed when EXIF is requested, including through getexif() or ImageOps.exif_transpose(). The declared pixel dimensions do not bound this metadata allocation, so decompression-bomb checks do not prevent process memory exhaustion. This issue is fixed in version 13.0.0.

• CWE-770

• https://github.com/python-pillow/Pillow/commit/4908edaf7f416616784c7c03d8c1a60153710ffb
• https://github.com/python-pillow/Pillow/commit/4b63dffd8a6d980fa0e21b40832fa6cbf033eacf
• https://github.com/python-pillow/Pillow/releases/tag/13.0.0
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-wqgw-9xfh-qf2g

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12802In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData…7.5
• CVE-2026-12803In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC d…7.5
• CVE-2026-12804A vulnerability was detected in lemonldap-ng up to 2.23.0. I…4.3
• CVE-2026-12805A flaw has been found in OFFIS DCMTK up to 3.7.0. The affect…6.3
• CVE-2026-12806A vulnerability has been found in Edimax BR-6478AC V2 1.23. …8.8
• CVE-2026-128065@grpc/grpc-js implements the core functionality of gRPC pure…6.9
• CVE-2026-128067Pillow is a Python imaging library. From 2.3.0 through 12.3.…8.4
• CVE-2026-12807A vulnerability was found in Edimax BR-6478AC V2 1.23. This …6.3
• CVE-2026-12808A vulnerability was determined in Edimax BR-6478AC V2 1.23. …6.3
• CVE-2026-12809A vulnerability was identified in Edimax BR-6478AC V2 1.23. …6.3
• CVE-2026-1281A code injection in Ivanti Endpoint Manager Mobile allowing …9.8
• CVE-2026-12810A security flaw has been discovered in Edimax BR-6478AC V2 1…6.3