CVE WATCH / VULNERABILITY DETAIL
CVE-2026-112396
MEDIUMCVSS 5.9NVD feed
Published 19 October 2026 · tracked since 20 October 2026
Description
Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in ImagingLibTiffEnc
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog