CVE-2026-112897

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-112897
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112897.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-112897
Aliases
Downstream
CGA (82)
CLEANSTART (2)
CLSA (6)
DEBIAN (1)
ECHO (1)
ROOT (1)
SUSE (1)
UBUNTU (1)
Related
Published
2026-10-19T22:00:52Z
Modified
2026-11-03T13:27:01Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
Details

Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the bytes written by libtiff, but Pillow converts the expected rows without clearing the unwritten tail. The tile path is affected from 5.3.0 and the strip path from 6.0.0. An attacker can supply a crafted TIFF to an application that loads and returns or re-encodes its pixels. This can disclose stale heap contents without memory corruption or a process crash. This issue is fixed in version 13.0.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-908"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112897.json"
}
References

Affected packages

Git / github.com/python-pillow/pillow

Affected ranges

Type
GIT
Repo
https://github.com/python-pillow/pillow
Events
Introduced
0ac14725ef4444fdb2871a54bcc95fcd6b8807b3
Fixed
293218ad059d994baf1777d882911bed6a49704a
Fixed
1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.3.0"
                },
                {
                    "fixed": "13.0.0"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "13.0.0",
            "range": [
                {
                    "fixed": "293218ad059d994baf1777d882911bed6a49704a"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

10.*
10.0.0
10.1.0
10.2.0
10.3.0
10.4.0
11.*
11.0.0
11.1.0
11.2.1
11.3.0
12.*
12.0.0
12.1.0
12.2.0
12.3.0
5.*
5.3.0
5.4.0
6.*
6.0.0
6.1.0
6.2.0
7.*
7.0.0
7.1.0
7.2.0
8.*
8.0.0
8.1.0
8.2.0
8.3.0
8.4.0
9.*
9.0.0
9.1.0
9.2.0
9.3.0
9.4.0
9.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112897.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "114388406725455065577623846774106027297",
            "length": 1626
        },
        "id": "CVE-2026-112897-1509fd25",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/python-pillow/pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce",
        "target": {
            "file": "src/libImaging/TiffDecode.c",
            "function": "_decodeTile"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "109318718624272006597121147684997697983",
            "length": 1509
        },
        "id": "CVE-2026-112897-2db35bd2",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/python-pillow/pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce",
        "target": {
            "file": "src/libImaging/TiffDecode.c",
            "function": "_decodeStrip"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "328365935906173800721085262800232642734",
                "195321506194420428618727489730490729853",
                "148552495936721358861664633257358077092",
                "252919732377402430014214623620038860482",
                "56426458705867469761562723932184733626",
                "96384748059883763698585287674903522444",
                "193529417125674732102475191454058063908",
                "195836092978962599462765811829252493199",
                "299026382235075243833872868253410302645",
                "2859015147738819786392833060040906327",
                "225983572568078280016530052772044498666",
                "82943386993380815693831529339323883448",
                "14446939228719583221420401205195809360",
                "53802593792708522609896543247124984221",
                "180565588861109677353675599231248795670",
                "170708454611785382970649880980374429778",
                "194205829702377816602101179673064497694",
                "56426458705867469761562723932184733626",
                "96384748059883763698585287674903522444",
                "193529417125674732102475191454058063908",
                "24346580415558004787531668250322418852",
                "318764249951350850777203596470562178742",
                "290418670345622815474836002354933328779"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-112897-f266896d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/python-pillow/pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce",
        "target": {
            "file": "src/libImaging/TiffDecode.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-29T07:24:16Z"