Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

影響: pip:pillow >= 11.3.0, < 13.0.0 → 13.0.0

Saving an image as TIFF to an in-memory buffer can trigger a heap use-after-free if libtiff rejects a tag at encode time. When TIFFWriteScanline fails, the encoder frees its output buffer but leaves the libtiff handle open. Later, when the encoder object is torn down, TIFFClose flushes buffered bytes through the write callback and writes into the freed buffer. An application that re-encodes attacker-influenced images to TIFF in memory can be crashed and is a candidate for remote code execution.…

在 GitHub Advisory Database 阅读

2026/10/22 06:24，GitHub Advisory Database 发布了“Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Python。CVE：CVE-2026-112396。