{"id":"ghsa-ghsa-462x-pgg6-55fp","seq":2385,"kind":"advisory","title":"Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)","url":"https://github.com/advisories/GHSA-462x-pgg6-55fp","permalink":"https://vulnpulse.app/items/ghsa-ghsa-462x-pgg6-55fp","summary":"影響: pip:pillow >= 8.2.0, < 13.0.0 → 13.0.0\nSummary Pillow's libImaging _decodeTile decoder, used to decode tiled TIFF images, allocates a per-tile buffer using realloc(state->buffer, TIFFTileSize(tiff)). After each TIFFReadTile it then iterates tile_y from 0 up to current_tile_length and calls the configured row unpacker (here copy4) with the source pointer state->buffer + tile_y row_byte_size. When libtiff returns a tile_bytes_size smaller than the worst-case row_byte_size tile_length, the inner stride-and-copy loop walks past the real…","severity":"medium","techs":["python"],"cves":["CVE-2026-112395"],"tags":["GHSA-462x-pgg6-55fp","pillow"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T20:49:26.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}