Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

影響: pip:pillow >= 11.3.0, < 13.0.0 → 13.0.0

Saving an image as TIFF to an in-memory buffer can trigger a heap use-after-free if libtiff rejects a tag at encode time. When TIFFWriteScanline fails, the encoder frees its output buffer but leaves the libtiff handle open. Later, when the encoder object is torn down, TIFFClose flushes buffered bytes through the write callback and writes into the freed buffer. An application that re-encodes attacker-influenced images to TIFF in memory can be crashed and is a candidate for remote code execution.…

GitHub Advisory Databaseで読む

2026/10/22 06:24、GitHub Advisory Databaseが「Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Python。CVE: CVE-2026-112396。