Copyright © 2012 Red Hat, Inc. All rights reserved.
Moderate
2026-10-19T21:02:15
pillow: pillow: arbitrary code execution via heap use-after-free during TIFF encoding
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-825
Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in ImagingLibTiffEncode; the error path then frees the output buffer without closing or clearing the TIFF handle, and later cleanup flushes through the write callback into freed memory, which can crash the process and may enable code execution. This issue is fixed in version 13.0.0.
A flaw was found in Pillow. This vulnerability allows a remote attacker to potentially execute arbitrary code or cause a Denial of Service (DoS). The issue occurs when an application encodes Tagged Image File Format (TIFF) data with untrusted tags into an in-memory buffer. When an invalid tag is rejected during encoding, improper error handling prematurely frees memory that is subsequently accessed during cleanup, triggering a heap use-after-free condition.
Exploit Intelligence
Out of support scope
exploit-intelligence/vulnerability-analysis-rhel9
Lightspeed Core
Fix deferred
lightspeed-core/lightspeed-stack-rhel9
Lightspeed Core
Fix deferred
lightspeed-core/rag-tool-cpu-rhel9
Lightspeed Core
Fix deferred
lightspeed-core/rag-tool-cuda-12.9-rhel9
OpenShift Lightspeed
Fix deferred
openshift-lightspeed/lightspeed-ocp-rag-rhel9
OpenShift Lightspeed
Fix deferred
openshift-lightspeed/lightspeed-service-api-rhel9
OpenShift Lightspeed
Fix deferred
openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9
Red Hat AI Inference Server
Fix deferred
rhaii/model-opt-cuda-rhel9
Red Hat AI Inference Server
Fix deferred
rhaiis/model-opt-cuda-rhel9
Red Hat AI Inference Server
Fix deferred
rhaiis/vllm-cpu-rhel9
Red Hat AI Inference Server
Fix deferred
rhaiis/vllm-cuda-rhel9
Red Hat AI Inference Server
Fix deferred
rhaiis/vllm-neuron-rhel9
Red Hat AI Inference Server
Fix deferred
rhaiis/vllm-rocm-rhel9
Red Hat AI Inference Server
Fix deferred
rhaiis/vllm-spyre-rhel9
Red Hat AI Inference Server
Fix deferred
rhaiis/vllm-tpu-rhel9
Red Hat AI Inference Server
Fix deferred
rhaii/vllm-cpu-rhel9
Red Hat AI Inference Server
Fix deferred
rhaii/vllm-cuda-rhel9
Red Hat AI Inference Server
Fix deferred
rhaii/vllm-gaudi-rhel9
Red Hat AI Inference Server
Fix deferred
rhaii/vllm-neuron-rhel9
Red Hat AI Inference Server
Fix deferred
rhaii/vllm-rocm-rhel9
Red Hat AI Inference Server
Fix deferred
rhaii/vllm-spyre-rhel9
Red Hat AI Inference Server
Fix deferred
rhaii/vllm-tpu-rhel9
Red Hat Ansible Automation Platform 2
Out of support scope
ansible-automation-platform-25/lightspeed-chatbot-rhel8
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-26/hub-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-26/lightspeed-chatbot-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-27/hub-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-27/lightspeed-chatbot-rhel9
Red Hat Ansible Automation Platform 2
Out of support scope
ansible-automation-platform/automation-dashboard-rhel9
Red Hat Ansible Automation Platform 2
Out of support scope
python3.11-pillow
Red Hat Ansible Automation Platform 2
Fix deferred
python3.12-pillow
Red Hat Ansible Automation Platform 2
Out of support scope
python3x-pillow
Red Hat Ansible Automation Platform 2
Out of support scope
python-pillow
Red Hat Enterprise Linux 8
Fix deferred
python-pillow
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-aws-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-azure-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-azure-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-gaudi-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-gcp-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/disk-image-cuda-rhel9
Red Hat Lightspeed Services for OCP
Fix deferred
lightspeed-services-ocp/ocp-rules-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhai-early-access/docling-sdk-cuda-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhai-early-access/docling-serve-cuda-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhai/guidellm-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-automl-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-autorag-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-caikit-tgis-serving-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-feature-server-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-kserve-agent-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-kserve-autogluon-server-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-kserve-controller-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-kserve-router-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-kserve-storage-initializer-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-llama-stack-core-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-llm-d-kv-cache-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-ogx-core-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-openvino-model-server-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cpu-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cpu-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cuda130-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cuda130-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-rocm64-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th-torch-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th-torch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th-torch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-training-cuda128-torch29-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-training-rocm64-torch29-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-trustyai-nemo-guardrails-server-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-vllm-gaudi-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9
Red Hat Quay 3
Out of support scope
quay/quay-rhel8
Red Hat Quay 3
Fix deferred
quay/quay-rhel9
Red Hat Satellite 6
Fix deferred
python3.12-pillow
Red Hat Satellite 6
Fix deferred
python-pillow
https://www.cve.org/CVERecord?id=CVE-2026-112396
https://nvd.nist.gov/vuln/detail/CVE-2026-112396
https://github.com/python-pillow/Pillow/commit/dc95da20207827a062cfbf551ee9f6031465a8bb
https://github.com/python-pillow/Pillow/releases/tag/13.0.0
https://github.com/python-pillow/Pillow/security/advisories/GHSA-4rr5-89j8-mwwm