Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
CVE-2026-112396
### Summary Saving an image as TIFF to an in-memory buffer can trigger a heap use-after-free if libtiff rejects a tag at
#advisory
共收录 22948 条相关情报。
← 返回所有主题Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts
CVE-2026-94423
Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host ke
Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no
CVE-2026-94140
Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes St
Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
CVE-2026-112406
``` ============================================================================ Infinite loop in PdfParser.rewrite_page
Pillow: APNG background disposal allocates full canvas before decompression bomb check
CVE-2026-112399
``` ============================================================================ APNG background disposal allocates full
Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
CVE-2026-114501
Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly cont
Pillow: MSP RLE decoder expands a tiny file into unbounded memory
CVE-2026-112892
### Summary The MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
CVE-2026-112894
``` ============================================================================ Quadratic-time DoS in PDF save_all (Pdf
Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()
CVE-2026-112391
### Summary `PdfParser`'s `get_value()` can recurse without any limit and crash with an uncaught `RecursionError`. It is
Pillow multi-frame loaders can reuse stale native image storage after mode transitions
CVE-2026-96639
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation c
Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
CVE-2026-96636
Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DC
TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization
CVE-2026-29001
TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achi
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
CVE-2026-96640
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py tre
Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
CVE-2026-96637
Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a l
Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search
CVE-2026-113811
Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure s
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
CVE-2026-96778
Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
CVE-2026-96643
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the rema
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
CVE-2026-96644
Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or
Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
CVE-2026-96641
Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/_imaging.c checks positive g
Pillow: TarIO negative size field causes infinite CPU-spin loop
CVE-2026-96642
Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal