Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

影響: pip:pillow >= 11.3.0, < 13.0.0 → 13.0.0

Saving an image as TIFF to an in-memory buffer can trigger a heap use-after-free if libtiff rejects a tag at encode time. When TIFFWriteScanline fails, the encoder frees its output buffer but leaves the libtiff handle open. Later, when the encoder object is torn down, TIFFClose flushes buffered bytes through the write callback and writes into the freed buffer. An application that re-encodes attacker-influenced images to TIFF in memory can be crashed and is a candidate for remote code execution.…

GitHub Advisory Database에서 읽기

2026. 10. 22. 오전 06:24, GitHub Advisory Database에서 "Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python. CVE: CVE-2026-112396.