Pillow Heap Out-of-Bounds Read in TIFF Decoding Exposes Memory

Pillow, a popular Python imaging library, contains a high-severity out-of-bounds read vulnerability within its TIFF decoding functionality. This flaw allows attackers to extract sensitive heap memory from the application process. Security researchers disclosed that the bug exists in the tile and RGBA decoding paths. The vulnerability affects versions 8.1.0 and later, with version 13.0.0 providing the necessary fix.

Root cause

The issue originates in the `TiffDecode.c` file, specifically within the `_decodeTile()` and `_decodeAsRGBA()` functions. These functions size their decode buffers based on libtiff's view of the pixel layout. However, they fail to verify that the unpacker's input rows fit within the buffer produced by libtiff. A discrepancy arises when duplicate tags like `PhotometricInterpretation` are present. Libtiff retains the first occurrence, while Pillow keeps the last. This mismatch causes Pillow to read beyond the allocated buffer.

Attack path

An attacker can exploit this by inducing an application to open a malformed compressed TIFF file. This often occurs in services that generate thumbnails, previews, or converted images from user uploads. The attacker receives back fragments of the process's heap memory, including pointer values. No special settings are required for this attack. If the malicious file is slightly larger, the process will crash instead. The amount of leaked memory does not increase with the number of tiles.

Affected versions

• Pillow versions 8.1.0 and later are vulnerable.
• The vulnerability persists in versions prior to 13.0.0.
• Version 13.0.0 is the patched version.

Mitigation

• Update Pillow to version 13.0.0 or later immediately.
• Validate image file integrity before processing.
• Monitor for unexpected crashes in image processing services.

Signals worth monitoring

Teams usually observe irregular memory access patterns or unexpected application crashes when this type of flaw is triggered. Check whether image processing services return corrupted data or fail to load standard files. Look for logs indicating malformed image headers or duplicate metadata tags. Containment moves often involve isolating the affected service and blocking suspicious file uploads. Review access logs for unusual upload patterns or repeated failed processing attempts. Ensure that monitoring tools capture detailed error messages from the decoding library.

Background: File upload vulnerabilities

Watch for unexpected file execution, odd filename characters, or storage directory traversal. Immediate signs include HTML injection in previews. Hidden signs involve MIME type mismatches and race conditions. Isolate the upload directory, enforce server-side validation, and rename files to random strings to prevent execution.

Read the full guide: File Upload Vulnerabilities: Warning Signs and Immediate Fixes

What to do and how to stay safe: Pillow

• Upgrade Pillow to the latest patched version available.
• Audit image upload endpoints for strict file validation.
• Monitor application logs for heap-related errors or crashes.
• Implement rate limiting on image processing APIs to reduce exposure.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Pillow are affected by this vulnerability?

Versions 8.1.0 and later, up to but not including 13.0.0, are affected.

What is the severity of this vulnerability?

The vulnerability is rated as high severity.

Is there a patch available for this issue?

Yes, version 13.0.0 includes the fix for this vulnerability.