Key points
- The flaw affects Pillow versions 5.3.0 through 12.9.9 and is rated high severity.
- Attacker-supplied TIFF files with short JPEG or fax data cause the leak.
- Version 13.0.0 fixes the issue by clearing unwritten buffer tails.
An attacker can read stale heap memory from a Python application if they can supply a crafted image file. The vulnerability exists in the Pillow imaging library, which fails to clear unused buffer space during decoding. This allows previously freed data to be returned as part of the image pixels, potentially exposing sensitive information without crashing the process.
In plain English
When Pillow opens certain TIFF files, it allocates memory for image data but does not always fill it completely. If the embedded image data is shorter than expected, the remaining memory contains old data from other processes. Pillow then returns this entire block as the image, leaking that stale memory to anyone who views or processes the resulting picture.
The background
The issue stems from how Pillow handles JPEG-compressed and Group 4 fax TIFF data. The library allocates buffers based on expected strip sizes but relies on libtiff to write the actual pixel data. When libtiff decodes fewer rows than allocated, Pillow copies the full buffer, including the uninitialised tail, into the final image object. This occurs in both tile and strip decoding paths.
What changes now
Version 13.0.0 of Pillow addresses this by ensuring that any unwritten portions of the decode buffer are cleared before being converted to image data. This prevents uninitialised memory from being exposed as pixels. Applications using earlier versions remain vulnerable to this information disclosure risk until they update to the patched release.
The attacker's path
Teams usually assess image processing services for exposure to untrusted input. This weakness serves the reconnaissance phase of an intrusion, allowing an adversary to read memory contents without executing code. Check whether applications accept user-uploaded images and return processed outputs. Ensure that any service handling external image files validates input strictly and limits access to decoded results, reducing the risk of accidental data leakage through image pixels.
What to do and how to stay safe: Pillow
- Upgrade Pillow to version 13.0.0 or later to apply the vendor-provided fix.
- Validate that image processing services reject malformed or unexpected file structures.
- Monitor applications for unexpected image outputs that might contain non-image data.
- Review access controls to ensure decoded images are not exposed to unauthorised users.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Pillow versions are affected by this vulnerability?
Versions from 5.3.0 up to, but not including, 13.0.0 are vulnerable.
Does this vulnerability allow remote code execution?
No, the source material states it discloses stale heap contents without memory corruption or process crash.
What type of files trigger this issue?
Crafted TIFF files containing JPEG-compressed or Group 4 fax data with short decodes trigger the leak.
