CVE-2026-112396 — Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

Affected: python-pillow Pillow

Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in ImagingLibTiffEncode; the error path then frees the output buffer without closing or clearing the TIFF handle, and later cleanup flushes through the write callback into freed memory, which can crash the process and may enable code execution. This issue is fixed in version 13.0.0.

GHSA-4rr5-89j8-mwwm — Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

Affected: PyPI: pillow

### Summary Saving an image as TIFF to an in-memory buffer can trigger a heap use-after-free if libtiff rejects a tag at encode time. When `TIFFWriteScanline` fails, the encoder frees its output buffer but leaves the libtiff handle open. Later, when the encoder object is torn down, `TIFFClose` flushes buffered bytes through the write callback and writes into the freed buffer. An application that re-encodes attacker-influenced images to TIFF in memory can be crashed and is a candidate for remote code execution.

### Details The failure path in `ImagingLibTiffEncode` frees `clientstate->data` for the in-memory case but does not close the TIFF or null `clientstate->tiff` (the file-descriptor branch just above it does set `tiff = NULL`):

- `src/libImaging/TiffDecode.c:1041-1046`

Teardown then calls `ImagingLibTiffEncodeCleanup`, which runs `TIFFClose(tiff)` because `tiff` is still set:

- `src/encode.c:99-101` - `src/libImaging/TiffDecode.c:955`

`TIFFClose` flushes through `_tiffWriteProc`, which reallocs and memcpys into the freed `state->data`:

- `src/libImaging/TiffDecode.c:103-115`

The Predictor tag is a convenient trigger: the floating-point predictor (value 3) is invalid for integer sample data, so libtiff aborts the write.

### PoC ```python import io from PIL import Image

# In-memory TIFF re-encode. libtiff rejects Predictor=3 (floating point) on integer # data, so TIFFWriteScanline fails. The encoder frees clientstate->data but leaves the # TIFF open; cleanup's TI…

Most recent entries from all

CVE-2026-112396 — Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

GHSA-4rr5-89j8-mwwm — Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer