## Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

- 種別: advisory
- 重大度: medium
- 関連技術: python
- CVE: CVE-2026-112396
- 公開日時: 2026-10-21T21:24:19.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-4rr5-89j8-mwwm)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-4rr5-89j8-mwwm

影響: pip:pillow >= 11.3.0, < 13.0.0 → 13.0.0
Saving an image as TIFF to an in-memory buffer can trigger a heap use-after-free if libtiff rejects a tag at encode time. When TIFFWriteScanline fails, the encoder frees its output buffer but leaves the libtiff handle open. Later, when the encoder object is torn down, TIFFClose flushes buffered bytes through the write callback and writes into the freed buffer. An application that re-encodes attacker-influenced images to TIFF in memory can be crashed and is a candidate for remote code execution.…