Pillow Memory Disclosure: Uninitialized Heap Data Leaked in TIFF JPEG Decoding Before 13.0.0 Fix
A flaw in Pillow versions 5.3.0 through 12.x returns stale process memory as image pixels when decoding specific TIFF files, allowing data disclosure.
Key points
- The vulnerability affects Python Pillow versions 5.3.0 up to but not including 13.0.0.
- It allows disclosure of uninitialized heap memory via crafted TIFF files with JPEG or Group 4 fax compression.
- A fix is available in Pillow version 13.0.0.
Python’s Pillow library returns uninitialized heap memory as image pixel data when processing certain TIFF files. This information disclosure flaw, tracked as CVE-2026-112897, affects versions 5.3.0 through 12.x. The issue occurs during the decoding of JPEG-compressed strips or Group 4 fax tiles. An attacker who can supply a crafted image and observe the resulting output can read stale memory contents from the application process.
Root cause
The flaw originates in the `TiffDecode.c` source file within the `_decodeStrip` and `_decodeTile` functions. According to the GitHub advisory, Pillow allocates a buffer using `realloc` without initializing the contents. It then calls `TIFFReadEncodedStrip` to fill this buffer. When the embedded JPEG or fax data contains fewer rows than expected, libtiff decodes only the available data but still returns the full strip size. Pillow copies the entire buffer into the image, including the unwritten tail that contains leftover heap data.
Attack path
An attacker must supply a specifically crafted TIFF file to a vulnerable application. The file must use JPEG compression for strips or Group 4 fax compression for tiles, with an embedded stream that ends early. The application must then load the image and expose the pixel data, such as by generating a thumbnail, preview, or converted copy. No memory corruption or process crash is required for this disclosure. The default configuration allows the operation to succeed silently, with no error or warning generated.
Affected versions
- Python Pillow version 5.3.0
- Python Pillow version 6.0.0
- Python Pillow version 12.x
- Any version prior to 13.0.0 is vulnerable.
- The strip path is affected from version 6.0.0.
- The tile path is affected from version 5.3.0.
Mitigation
- Upgrade Python Pillow to version 13.0.0.
- Verify that all application dependencies are updated to the patched version.
- Restrict image uploads to trusted sources where possible.
- Monitor for unexpected memory access patterns in image processing services.
Signals worth monitoring
Security operations teams should check application logs for silent failures or unusual processing times during image decoding, as this flaw operates without errors. Look for anomalies in pixel data distributions in generated thumbnails or previews, which may indicate leaked memory rather than actual image
What to do and how to stay safe
- Asset discovery is only the first step; context determines risk.
- Internal assets become external risks through cloud misconfigurations.
- Prioritization requires correlating vulnerability data with business criticality.
Attack surface management is continuous, contextual, and human-guided. Start by mapping your external assets and prioritizing risks based on business impact.
Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views
General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
