CVE-2026-128066 | Pillow up to 12.3.0 TIFF IFD TiffImagePlugin.py ImageFileDirectory_v2.load memory allocation

November 13, 2026 Yanac

A vulnerability has been found in Pillow up to 12.3.0 and classified as problematic. Affected by this vulnerability is the function ImageFileDirectory_v2.load of the file src/PIL/TiffImagePlugin.py of the component TIFF IFD Handler. This manipulation causes uncontrolled memory allocation.

The identification of this vulnerability is CVE-2026-128066. It is possible to initiate the attack remotely. There is no exploit available.

The affected component should be upgraded.VulDB Recent EntriesRead More