CVE-2026-112393

A flaw was found in Pillow. When saving compressed Tagged Image File Format (TIFF) images into memory buffers rather than direct files, the library incorrectly calculates the required memory allocation. A remote attacker who supplies a crafted image for processing can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) through process crashes. Additionally, uninitialized memory gaps can result in information disclosure by leaking remnants of previously stored data.

The attack complexity is high and also for services that do hit this code path (image upload → TIFF re-encode to BytesIO → return/upload), the minimal PoC reliably crashes the worker process. The heap corruption could plausibly be developed into RCE by a skilled attacker who has already compromised the same process enough to leak addresses, but that's a chained-exploit scenario, not a standalone wormable RCE.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.