{"id":"CVE-2026-112896","summary":"Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read","details":"Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read. This can disclose heap memory in the output or crash the process. This issue is fixed in version 13.0.0.","aliases":["GHSA-pchr-8j38-3x4p"],"modified":"2026-10-21T09:40:06.403070425Z","published":"2026-10-19T21:59:17.743Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112896.json","unresolved_ranges":[{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"fixed":"13.0.0"}],"source":"AFFECTED_FIELD"}]},{"extracted_events":[{"range":[{"fixed":"13.0.0"},{"fixed":"13.0.0"}],"source":"DESCRIPTION"}]}],"cna_assigner":"GitHub_M","cwe_ids":["CWE-125"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112896.json"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/d03dc3c587a9b0bdc9e4304d70d59a635a87b742"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-pchr-8j38-3x4p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112896"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/python-pillow/pillow","events":[{"introduced":"0"},{"fixed":"d03dc3c587a9b0bdc9e4304d70d59a635a87b742"},{"fixed":"293218ad059d994baf1777d882911bed6a49704a"}],"database_specific":{"extracted_events":[{"source":"REFERENCES_COMMIT","range":[{"fixed":"d03dc3c587a9b0bdc9e4304d70d59a635a87b742"}]},{"source":"REFERENCES_TAG","original_tag":"13.0.0","range":[{"fixed":"293218ad059d994baf1777d882911bed6a49704a"}]}]}}],"versions":["12.3.0","12.2.0","12.1.0","12.0.0","11.3.0","11.2.1","11.1.0","11.0.0","10.4.0","10.3.0","10.2.0","10.1.0","10.0.0","9.5.0","9.4.0","9.3.0","9.2.0","9.1.0","9.0.0","8.4.0","8.3.0","8.2.0","8.1.0","8.0.0","7.2.0","7.1.0","7.0.0","6.2.0","6.1.0","6.0.0","5.4.0","5.3.0","5.2.0","5.1.0","5.0.0","4.3.0","4.2.0","4.1.0","4.0.0","4.0.0a","3.4.0","3.3.0","3.2.0","3.1.0","3.1.0-rc1","2.9.0","2.9.0.dev2","2.9.0.dev1","2.9.0.dev0","2.8.1","2.8.0","2.7.0","2.5.0","2.3.0","2.2.1","2.2.0","2.1.0","2.0.0","1.7.8","1.7.7","1.2","1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112896.json","vanir_signatures":[{"source":"https://github.com/python-pillow/pillow/commit/d03dc3c587a9b0bdc9e4304d70d59a635a87b742","target":{"file":"src/encode.c","function":"PyImaging_LibTiffEncoderNew"},"deprecated":false,"digest":{"length":7664,"function_hash":"139866555655869194362188750479426904228"},"id":"CVE-2026-112896-606366a7","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/encode.c"},"deprecated":false,"digest":{"line_hashes":["188248090771022942508566252397842350530","205415375043770229192186793317719380113","336413898751525635744859177285855710561","178014696261702239022211842796710700889","207148191545491809986849339541240217179","254147085627328829751884066416467974880","5237343998421203492945568509779695900","34945384489361112400804635831710662341","44186797794568488336927852786661693627","24700233783016866379902538461987043096","10879944978043972304669808308800919077","125975275529534663727637840603364176582","164755224853526042662011869360048810259","60935701479658185645753894944650191642","145168116417046508419665958080865885311","282092314630549595754917927374351913866","105485908635323615425587135668750614518","132259914308561545897836904661970549950","290262850500520022667767463663082388138","152977170281505624254778545732031163547","129079202910940739459610720001835583168","114871418915289992830694276068159776983","84517620514724866105651765720208048395","85123425676955862524451798965333453075"],"threshold":0.9},"id":"CVE-2026-112896-9f126aa2","signature_type":"Line","signature_version":"v1","source":"https://github.com/python-pillow/pillow/commit/d03dc3c587a9b0bdc9e4304d70d59a635a87b742"}],"vanir_signatures_modified":"2026-10-21T09:40:06Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}]}