Vulnerability PYSEC-2026-4363
Critical
CRITICAL RISK
CVSS Score: 9.1
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
6 days ago
November 05, 2026 at 09:18 PM UTC
No summary available
1.0 and 1.1 and 1.2 and 1.3 and 1.4 and 1.5 and 1.6 and 1.7.0 - 3.0.0 and 3.1.0.rc1 and 3.1.0rc1 and 3.1.0 - 5.3.0 and 5.4.0.dev0 and 5.4.0 - 11.1.0 and 11.2.1 - 12.3.0
1.0 and 1.1 and 1.2 and 1.3 and 1.4 and 1.5 and 1.6 and 1.7.0 - 3.0.0 and 3.1.0.rc1 and 3.1.0rc1 and 3.1.0 - 5.3.0 and 5.4.0.dev0 and 5.4.0 - 11.1.0 and 11.2.1 - 12.3.0
Details
Pillow is a Python imaging library. In versions through 12.3.0, the libtiff TIFF encoder can pass arguments to TIFFSetField() that do not match libtiff’s definition of the corresponding tag. When an application saves attacker-controlled image metadata through this encoder, crafted tag values can cause invalid memory reads, copying process memory into the encoded output or crashing the process. Applications that return the encoded output to an attacker can disclose that memory. The issue is reachable when re-saving compressed TIFF images and through certain conversions that preserve EXIF metadata into compressed TIFF output. This vulnerability is fixed in version 13.0.0.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
19 days ago
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
1.0 and 1.1 and 1.2 and 1.3 and 1.4 and 1.5 and 1.6 and 1.7.0 - 3.0.0 and 3.1.0.rc1 and 3.1.0rc1 and 3.1.0 - 5.3.0 and 5.4.0.dev0 and 5.4.0 - 11.1.0 and 11.2.1 - 12.3.0 GHSA-5x8w-8jj5-q52h
1.0 and 1.1 and 1.2 and 1.3 and 1.4 and 1.5 and 1.6 and 1.7.0 - 3.0.0 and 3.1.0.rc1 and 3.1.0rc1 and 3.1.0 - 5.3.0 and 5.4.0.dev0 and 5.4.0 - 11.1.0 and 11.2.1 - 12.3.0 GHSA-5x8w-8jj5-q52h
Medium Risk
19 days ago
Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
11.2.1 - 12.3.0 GHSA-654x-cwwv-5j9c
11.2.1 - 12.3.0 GHSA-654x-cwwv-5j9c
High Risk
20 days ago
Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()
11.1.0 and 11.2.1 - 12.3.0 GHSA-78g4-xqwv-q3g8
11.1.0 and 11.2.1 - 12.3.0 GHSA-78g4-xqwv-q3g8
High Risk
20 days ago
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
9.4.0 - 11.1.0 and 11.2.1 - 12.3.0 GHSA-g7cr-3p24-7wf7
9.4.0 - 11.1.0 and 11.2.1 - 12.3.0 GHSA-g7cr-3p24-7wf7
High Risk
20 days ago
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
1.0 and 1.1 and 1.2 and 1.3 and 1.4 and 1.5 and 1.6 and 1.7.0 - 3.0.0 and 3.1.0.rc1 and 3.1.0rc1 and 3.1.0 - 5.3.0 and 5.4.0.dev0 and 5.4.0 - 11.1.0 and 11.2.1 - 12.3.0 GHSA-9v9v-9qvf-h2hj
1.0 and 1.1 and 1.2 and 1.3 and 1.4 and 1.5 and 1.6 and 1.7.0 - 3.0.0 and 3.1.0.rc1 and 3.1.0rc1 and 3.1.0 - 5.3.0 and 5.4.0.dev0 and 5.4.0 - 11.1.0 and 11.2.1 - 12.3.0 GHSA-9v9v-9qvf-h2hj
Impacted packages
Timeline
Published
6 days ago
November 05, 2026 at 09:18 PM UTC
Fixed (13.0.0)
26 days ago
October 16, 2026 at 10:17 PM UTC
Last Modified
21 hours ago
November 11, 2026 at 10:00 AM UTC