CVE-2026-112902: pillow — Exploit & Fix

Description

Pillow is a Python imaging library. In versions through 12.3.0, the libtiff TIFF encoder can pass arguments to TIFFSetField() that do not match libtiff’s definition of the corresponding tag. When an application saves attacker-controlled image metadata through this encoder, crafted tag values can cause invalid memory reads, copying process memory into the encoded output or crashing the process. Applications that return the encoded output to an attacker can disclose that memory. The issue is reachable when re-saving compressed TIFF images and through certain conversions that preserve EXIF metadata into compressed TIFF output. This vulnerability is fixed in version 13.0.0.

Is your site exposed to CVE-2026-112902?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS — Exploit Prediction

0.0061

Probability of exploitation

0.50%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-686 CWE-686

Affected Products

Vendor	Product	Versions
python	pillow	< 13.0.0

References

Advisories & Patches

https://github.com/python-pillow/Pillow/commit/570df030c0d30c2bf5336b2ab59f3902d8ab0b6d https://github.com/python-pillow/Pillow/pull/10227 https://github.com/python-pillow/Pillow/security/advisories/GHSA-xvh5-g6gv-559v

Exploits

https://github.com/python-pillow/Pillow/security/advisories/GHSA-xvh5-g6gv-559v

Other References

https://github.com/python-pillow/Pillow/releases/tag/13.0.0

Frequently Asked Questions

What is CVE-2026-112902? +

Pillow is a Python imaging library. In versions through 12.3.0, the libtiff TIFF encoder can pass arguments to TIFFSetField() that do not match libtiff’s definition of the corresponding tag. When an application saves attacker-controlled image metadata through this encoder, crafted tag values can cause invalid memory reads, copying process memory into the encoded output or crashing the process. Applications that return the encoded output to an attacker can disclose that memory. The issue is reachable when re-saving compressed TIFF images and through certain conversions that preserve EXIF metadata into compressed TIFF output. This vulnerability is fixed in version 13.0.0. It has a CVSS v3.1 base score of 9.1 (CRITICAL).

How severe is CVE-2026-112902? +

CVE-2026-112902 has a CVSS v3.1 score of 9.1 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately. The EPSS score is 0.0061, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-112902? +

CVE-2026-112902 affects products from python, specifically: pillow. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-112902? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-78422

Subject::new_for_owner() in the zbus_polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus …

CVE-2025-14330 9.8

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, …

CVE-2026-8389 7.3

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.

CVE-2024-32632 6.6

A value in ATCMD will be misinterpreted by printf, causing incorrect output and possibly out-of-bounds memory access

CVE-2026-96639 9.8

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a …

CVE-2025-47273 8.8

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability …

CVE-2026-112902