CVE-2026-128067 | python-pillow Pillow up to 12.3.0 TIFF Image TiffImagePlugin.py TiffImagePlugin._save exif/tiffinfo heap-based overflow

November 13, 2026 Yanac

A vulnerability, which was classified as critical, has been found in python-pillow Pillow up to 12.3.0. This impacts the function TiffImagePlugin._save of the file TiffImagePlugin.py of the component TIFF Image Handler. The manipulation of the argument exif/tiffinfo leads to heap-based buffer overflow.

This vulnerability is uniquely identified as CVE-2026-128067. The attack is possible to be carried out remotely. No exploit exists.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More