CVE-2026-128066
Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data
Description
Pillow is a Python imaging library. From 1.0 through 12.3.0, ImageFileDirectory_v2.load() in src/PIL/TiffImagePlugin.py retains a separate bytes object for each out-of-line IFD tag value without limiting the total data read or preventing distinct tags from referencing the same file region. A small crafted TIFF or EXIF-bearing JPEG, PNG, WebP, or MPO can therefore cause memory use quadratic in the input size. TIFF and some JPEG paths trigger parsing during Image.open(), while other formats are exposed when EXIF is requested, including through getexif() or ImageOps.exif_transpose(). The declared pixel dimensions do not bound this metadata allocation, so decompression-bomb checks do not prevent process memory exhaustion. This issue is fixed in version 13.0.0.
INFO
Published Date :
Nov. 12, 2026, 10:47 p.m.
Last Modified :
Nov. 12, 2026, 10:47 p.m.
Remotely Exploit :
No
Source :
GitHub_M
Solution
- Update Pillow to version 13.0.0.
- Avoid processing untrusted TIFF or JPEG files.
- Limit file size and metadata content.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-128066 vulnerability anywhere in the article.