## Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

- 種別: advisory
- 重大度: medium
- 関連技術: python
- CVE: CVE-2026-112395
- 公開日時: 2026-10-20T20:49:26.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-462x-pgg6-55fp)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-462x-pgg6-55fp

影響: pip:pillow >= 8.2.0, < 13.0.0 → 13.0.0
Summary Pillow's libImaging _decodeTile decoder, used to decode tiled TIFF images, allocates a per-tile buffer using realloc(state->buffer, TIFFTileSize(tiff)). After each TIFFReadTile it then iterates tile_y from 0 up to current_tile_length and calls the configured row unpacker (here copy4) with the source pointer state->buffer + tile_y row_byte_size. When libtiff returns a tile_bytes_size smaller than the worst-case row_byte_size tile_length, the inner stride-and-copy loop walks past the real…