{"affected":[{"product":"Pillow","source":"CNA: GitHub_M","vendor":"python-pillow","versions":[{"status":"affected","version":">= 2.3.0, < 13.0.0"}]}],"cveId":"CVE-2026-128067","cwes":["CWE-787"],"description":"Pillow is a Python imaging library. From 2.3.0 through 12.3.0, Pillow applications that save compressed TIFF images through libtiff can pass attacker-controlled image geometry tags to the encoder while allocating its row buffer from the actual image dimensions. The affected TiffImagePlugin._save path allows ImageWidth, ImageLength, or SamplesPerPixel from exif=, tiffinfo=, or a source TIFF IFD to make libtiff consume a larger scanline than the buffer supplied by ImagingLibTiffEncode. This can read heap memory into the generated TIFF or crash the process. When TIFF Predictor 2 is enabled, libtiff can rewrite the oversized scanline in place and corrupt memory beyond the buffer. A carried-over PlanarConfiguration value of 2 instead makes libtiff use a shorter scanline and can produce an undecodable output file, but is not established to cause the out-of-bounds access. This issue is fixed in version 13.0.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.4,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794523798221,"publishedAt":1794523798221,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xcvg-w56q-r89m"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/python-pillow/Pillow/commit/53318b50e8e9e85a57d033d4d879e1398d97aeb1"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/python-pillow/Pillow/commit/ec5f1cbcf67275641abaad5c065ffb64a0a804a9"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"remediation":[],"revision":"9a20bb1f7c51be16aef6f59022057ff9fd87b58e161e1c2b0fe164f8c86aa399","sources":[{"modifiedAt":1794523798221,"name":"CNA: GitHub_M","retrievedAt":1794524940782,"url":"https://www.cve.org/CVERecord?id=CVE-2026-128067"}],"ssvc":null,"status":"published","title":"Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size","updatedAt":1794524940782}