CVE-2026-112396

A flaw was found in Pillow. This vulnerability allows a remote attacker to potentially execute arbitrary code or cause a Denial of Service (DoS). The issue occurs when an application encodes Tagged Image File Format (TIFF) data with untrusted tags into an in-memory buffer. When an invalid tag is rejected during encoding, improper error handling prematurely frees memory that is subsequently accessed during cleanup, triggering a heap use-after-free condition.

This vulnerability is rated as Moderate impact for Red Hat products because exploitation requires specific and uncommon application workflows where untrusted metadata is accepted and serialized into TIFF format within an in-memory buffer. Exploitation relies on strict preconditions, specifically libtiff rejecting malformed tags during in-memory encoding, making remote code execution difficult and predominantly resulting in process termination. Typical Red Hat product deployments do not expose arbitrary, in-memory TIFF re-encoding endpoints accepting unvalidated user tags directly to unauthenticated network clients.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.