Listen to this Post
Pillow’s libImaging _decodeTile decoder processes tiled TIFF images by allocating a per-tile buffer based on the size returned by libtiff. It iterates through the tile rows, using an unpacker function to copy the pixels into the image buffer. However, when libtiff returns a tile data size smaller than the worst-case stride calculation expects, the inner loop continues to read past the boundary of the reallocated buffer. This out-of-bounds read can be triggered using a carefully crafted TIFF file, leading to a process crash or causing adjacent heap memory contents to be inadvertently copied into the decoded pixel buffer.
DailyCVE Form:
Platform: Python Pillow
Version: 8.2.0 to 13.0.0
Vulnerability : Out-of-bounds Read
Severity: Moderate
date: 2026-10-17
Prediction: 2026-10-24
What Undercode Say
Analysis of the code reveals a mismatch between the size reported by `TIFFTileSize` and the memory footprint assumed by the inner row-unpacking loops in TiffDecode.c. The decoder validates against oversized tiles but fails to check for undersized tiles where `tile_bytes_size` is strictly less than row_byte_size tile_length. Consequently, functions like `copy4` read past the allocated region, causing undefined memory access or crashes detected by ASAN.
Exploit: (Educational Purposes!)
Conceptual Proof-of-Concept snippet to demonstrate crafted TIFF handling
import io
from PIL import Image
Crafted TIFF tile parameters triggering mismatched stride lengths
Generating a malformed TIFF structure with undersized tile bytes relative to row_byte_size tile_length
malformed_tiff_data = b"II\x00..." truncated representation
try:
img = Image.open(io.BytesIO(malformed_tiff_data))
img.load()
except Exception as e:
print(f"Triggered exception or crash: {e}")
Protection:
Upgrade the `Pillow` library to version 13.0.0 or higher, which incorporates bounds checks to ensure that the unpacker’s input row size fits strictly within the row data produced by libtiff.
Impact:
An attacker capable of tricking an application into decoding a malformed TIFF file can trigger a denial of service via application crash, or potentially leak adjacent heap memory contents into output pixel data.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
