Pillow libtiff TIFF encoder passes wrong arguments, leaking memory and crashing
A photo library can leak memory or crash.
Summary
Pillow's libtiff TIFF encoder passes arguments that do not match the tag definitions, so attacker-controlled image metadata can copy process memory into the output or crash the process. Applications that return the encoded output to an attacker are affected.
Affected when
- Re-saving compressed TIFF images
- Converting with EXIF metadata preserved into compressed TIFF output
What to do
Update Pillow to 13.0.0 or later.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen