CVE-2026-128067: Pillow TIFF flaw leaks heap memory
A heap buffer overflow in the Python imaging library Pillow can leak server memory into an output file or crash the process when an application saves a crafted image as a compressed TIFF. The flaw, tracked as CVE-2026-128067, affects Pillow versions 2.3.0 through 12.3.0 and is fixed in version 13.0.0, according to the project's security advisory. The CVE record was published on 13 November 2026.
Pillow is one of the most widely used image-processing libraries in Python, sitting behind image uploads, thumbnailing, format conversion and document pipelines in web applications. Any service that turns a user-supplied image into a TIFF file through Pillow's libtiff encoder is in scope.
How the flaw works
When Pillow saves an image as a compressed TIFF, it hands the image's geometry to the libtiff encoder through tags such as ImageWidth, ImageLength and SamplesPerPixel. The advisory explains that those tags can come from attacker-controlled data: the EXIF data of an uploaded JPEG, tags passed in through the exif= or tiffinfo= save arguments, or the source TIFF file's own image file directory.
Pillow sizes its row buffer from the image's real dimensions, but libtiff sizes the scanline it consumes from the tags it was given. Nothing compares the two. If the tags describe a wider image than the real one, libtiff reads past the end of the buffer. The advisory's reproducer shows a 64-by-4 greyscale JPEG whose EXIF data claims three samples per pixel being converted into a valid RGB TIFF in which 128 bytes of each row are live heap memory, including pointers that change from run to run. The same JPEG with an EXIF ImageWidth of 2 to the power of 27 kills the process with a segmentation fault.
Predictor 2 turns a leak into corruption
The flaw gets worse when TIFF Predictor 2 compression is enabled. In that case libtiff first rewrites the whole oversized scanline in place, using horizontal differencing, so the out-of-bounds read becomes an out-of-bounds heap write on every row. The advisory reports that the process then dies with a glibc abort. The write variant needs nothing more than a small crafted TIFF file and the metadata-preserving save pattern used in Pillow's own tests.
Notably, one trigger needs no save arguments at all. A crafted palette TIFF carries its compression and predictor settings with it, so a bare Image.open(f).save(out, "TIFF") format-normalisation step can already hand libtiff a scanline wider than the buffer. The tiffinfo= route dates back to Pillow 2.3.0, and the exif= route to version 8.4.0.
Who is affected and what to do
The advisory says the affected applications are those that write TIFF output from user-supplied images through libtiff, which covers any compression setting other than raw. That includes archival, print and scan pipelines and any service that converts uploads to TIFF while carrying the metadata across. The non-libtiff path, used when no compression is requested, is not affected.
The fix is to update Pillow to version 13.0.0 or later. The CVE record rates the flaw HIGH under CVSS 4.0 and classes it as CWE-787, an out-of-bounds write. The advisory does not report any exploitation in the wild, but the reproducer is public and the trigger is an ordinary image upload, so teams running image-conversion services should treat the update as urgent and check whether their code saves TIFF files from untrusted images.
