## Summary
A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 (ColorMap) with **768 SHORT values**: three zero-filled planes of 256 entries each. No Python object is forged and no metadata is injected after loading.
Pillow's TIFF encoder allocates **768 × 2 = 1536 bytes**, then passes three plane pointers separated by 256 SHORT entries to libtiff. With `BitsPerSample = 16`, libtiff instead expects **65536 SHORT values per plane** and attempts a **131072-byte read** from a plane pointer. Existing ASAN observations identify a heap-buffer-overflow READ crossing the 1536-byte allocation made in `PyImaging_LibTiffEncoderNew`.
The malformed ColorMap need not be a valid palette for this grayscale image. The issue is that accepted metadata is forwarded on save without reconciling the fixed plane extent with the effective sample depth. Opening/loading alone is not the demonstrated fault; the encoder path is required.
## Impact and prerequisites
An application must accept the input, retain the relevant TIFF metadata, and invoke the libtiff-backed TIFF save path. The observed consequence is an out-of-bounds read and ASAN termination. Process-memory exposure during encoding is a potential consequence, **not demonstrated by extracting arbitrary heap contents in this report**. No arbitrary read primitive, full memory-disclosure chain, code execution, address-space bypass, or cross-process effect is claimed.
The 131072-byte attempted copy is not the number of bytes proven disclosed. This report does not run a synthetic-canary serializer or collect an unsanitized encoded output.
## Tested environment and limits of the evidence
The existing observations were recorded on August 30, 2026, with **CPython 3.11.8 on macOS ARM64**, using the unmodified official **Pillow 12.3.0** wheel and its bundled **libtiff 4.7.1**:
- Wheel: `pillow-12.3.0-cp311-cp311-macosx_11_0_arm64.whl`
- Wheel size: `4785266` bytes
- Wheel SHA-256: `37d6d0a00072fd2948eb22bce7e1475f34569d90c87c59f7a2ec59541b77f7a6`
- Pillow source revision: `bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d`
- Bundled libtiff SHA-256: `e8988717b7470394a47d5ccd343130796b24ee70b6d885d3818e0e0b53238be1`
Apple's ASAN runtime was injected at process startup. This is **not an ASAN-rebuilt Pillow wheel**; allocation/memcpy interception detects the reported boundary violation, but the wheel's native instructions are not comprehensively instrumented.
Only this concrete full-package environment is established here. No affected-version range, current development-branch result, or patched release is asserted. Severity is **Unknown**; no CVSS score is proposed.
Separate earlier evidence reached the original Pillow 8.0.1 encoder constructor compiled as a component against a modern Python/libtiff environment. **That was not a complete Pillow 8.0.1 installation** and does not establish the historical package's full runtime behavior. It is not part of this reproducer or an affected-version range.
## Observed evidence and controls
The earlier integration harness performed the natural sequence `Image.open(BytesIO(input))`, `image.load()`, then `image.save(BytesIO(), format="TIFF")`, without replacing the image's metadata. Each case was recorded three times:
| Original fixture | Bytes | Recorded result |
| --- | ---: | --- |
| `colormap16` | 1685 | Loaded as `I;16`; save terminated with ASAN exit 86, READ of size 131072 crossing a 1536-byte heap region (3/3). |
| `colormap8` | 1684 | Same fixed ColorMap, but 8-bit samples; save succeeded and retained SHORT/count 768 (3/3). |
| `colormap_absent` | 137 | Same 16-bit geometry without ColorMap; save succeeded (3/3). |
Address-free summary of the recorded native diagnostic:
```text
AddressSanitizer: heap-buffer-overflow
READ of size 131072
0 bytes after 1536-byte region
Copy path: memcpy -> _TIFFmemcpy -> setByteArray -> _TIFFsetShortArrayExt
-> _TIFFVSetField -> TIFFVSetField -> ImagingLibTiffSetField
-> PyImaging_LibTiffEncoderNew
Allocation: calloc -> PyImaging_LibTiffEncoderNew
```
Input SHA-256 values (also enforced inside the script):
- `colormap16`: `5f38e0ead90b97949fb0c98c63f9c68d00ba9181db6631ecb8927376dcc75f4d`
- `colormap8`: `fdb26d9135549ed44824901985086c5ee4f06515699ca3291e498c523935405c`
- `colormap_absent`: `bd54979624f3ffb713342e0458caff9e17c477f940cda2f0960feebfabbc9556`
## Root cause and source references
- [Pillow `src/encode.c`, lines 870–899, pinned revision](https://github.com/python-pillow/Pillow/blob/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d/src/encode.c#L870): the ColorMap tuple must contain exactly 768 entries; a 1536-byte allocation is passed with a fixed stride of 256. The check does not reconcile that extent with `BitsPerSample`.
- [Pillow `src/PIL/TiffImagePlugin.py`, lines 1944–19
Bulletin ID: 2026-048-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/29/2026 11:15 PM PDT Description: AWS WAF is a web application firewall that monitors the HTTP(S) requests that are forwarded to your protected web application resources. We identified CVE-2026-13762 and CVE-2026-13763, which are issues affecting HTTP/2 multi-frame request body inspection by AWS WAF. CVE-2026-13762 affects AWS WAF deployment with CloudFront. This issue was remediated server-side; no customer action is required. CVE-2026-13763 affects AWS WAF deployment with AWS Application Load Balancer (ALB). Under certain conditions, a crafted multi-frame HTTP/2 request could cause only a partial request body to be inspected. This issue has been addressed on ALB, and customers can ensure full protection by configuring how AWS WAF inspects HTTP/2 request bodies on their ALB. Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
This update for python311 fixes the following issues:
- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).
- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).
- CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free
(bsc#1283969).
- CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses
(bsc#1283826).
- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).
- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file
modification and content disclosure (bsc#1280459).
Changes for python311:
- Update to 3.11.17:
- Security
- gh-158446: Fix a crash or incorrect output that could occur
when formatting a float or complex with a precision close
to the platform's INT_MAX. PyOS_double_to_string() now
raises ValueError for any precision of that magnitude,
regardless of presentation type or value, as the format
string parsers already did for precisions above INT_MAX.
- gh-157190: Fixed a vulnerability in the tarfile data and
tar extraction filters where a crafted archive using a hard
link to a symbolic link could change the permissions and
modification time of a file outside the destination
directory, and expose its contents inside the extracted
tree. This addresses CVE 2026-82049. (bsc#1280459,
CVE-2026-82049)
- gh-156793: asyncio: loop.start_tls() and
loop.create_connection() now validate the server_hostname
argument if an ssl.SSLContext is passed with check_hostname
set to True, emitting DeprecationWarning if server_hostname
is missing. (This will raise ValueError in Python 3.13 and
later.) (bsc#1283826, CVE-2026-19553)
- gh-156793: ssl.SSLContext.wrap_bio() now validates its
server_side, server_hostname and session arguments similar
to ssl.SSLContext.wrap_socket(), but for backward
compatiblity reasons emits DeprecationWarning instead of
ValueError.
In particular, a context with check_hostname enabled and no
server_hostname passed to wrap_bio() now emits
DeprecationWarning to indicate the hostname wasn't
checked. (In Python 3.13 and later, this raises
ValueError.)
- gh-157265: In tarfile, when extracting a link falls back to
extracting a member of the archive, skip the member when
the filter function returns None when called with the
extracted member's name replaced with the link's.
- gh-157953: Update bundled libexpat to version 2.8.5.
- gh-156002: Bound the amount of data zipfile decompresses
per read for members compressed with bzip2, LZMA, or
Zstandard, matching the existing limit for deflate. A small
archive member could previously expand into an unbounded
allocation even when read in small chunks. (bsc#1277111,
CVE-2026-15310)
- gh-155999: Fix the tarfile tar and data extraction filters
creating directories outside the destination for members
whose name leaves the destination and returns to it, such
as ../evil/../dest/sub/file. The containment check used the
resolved path, but intermediate directories were created
from the name as given. (bsc#1276227, CVE-2026-19672)
- gh-156293: Fix a crash in ssl when an sni_callback switches
a connection to another SSLContext and the context that
carries the callback is no longer referenced by the
application. Servers that keep their sni_callback context
alive (the usual case when it wraps the listening socket or
is stored on the server object) were not affected. This
addresses CVE-2026-19445. (bsc#1283969, CVE-2026-19445)
- gh-155292: Change the stringprep module and encodings.idna
codec to not consider Unicode codepoint attributes beyond
those defined in RFC 3454. (bsc#1276226, CVE-2026-17084)
- gh-155694: Fix CVE-2026-15806 by scoping HTTPPasswordMgr
credentials to the URL scheme, preventing credentials
stored for an HTTPS URL from being used for a matching HTTP
URL, while URIs without a scheme continue to match any
scheme. (bsc#1276223, CVE-2026-15806)
- Library
- gh-156002: zipfile again reads members through a
third-party decompressor installed by monkey-patching the
private _get_decompressor() to return an object that only
implements old BZ2Decompressor API from Python 3.3. Note
that decompressors without needs_input and two-argument
decompress() are vulnerable to CVE 2026-15310.
- gh-156353: Fix configparser parsing when using whitespace
in delimiters.
- Build
- gh-155757: Set the --argv0 argument to wasmtime for WASI
builds so the test suite passes. Otherwise the calculated
paths to the stdlib for frozen modules is incorrect.
- CVE-2026-15310: bound zipfile decompression for
bzip2/LZMA (bsc#1277111, gh#python/cpython#156002)
Red Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update
FIXED BUGS:
==========
DFBUGS-9380: [Backport to odf-4.17.z] Backport CA related fixes for NooBaa
DFBUGS-7336: [Backport to odf-4.17.z] [5.20] Update nodejs from v22.11.0 to v24.13.0
DFBUGS-7106: [Backport to 4.17.z] CLONE - ODF Console is breaking
DFBUGS-7065: RHODF 4.17.28 release
DFBUGS-6744: Backport to odf-4.17.z ODF 4.16.21- noobaa-endpoint crashes with Exit Code 1 due to unhandled AbortError from @azure/storage-blob
Red Hat OpenShift Data Foundation 4.16.36 security, enhancement & bug fix update
FIXED BUGS:
==========
DFBUGS-9792: Use Azure Storage Account GPv2
DFBUGS-9382: [Backport to odf-4.16.z] [Backport to 4.22] Backport CA related fixes for NooBaa
DFBUGS-7335: [Backport to odf-4.16.z] [5.20] Update nodejs from v22.11.0 to v24.13.0
DFBUGS-7030: [Backport to odf-4.16.z] [GSS] noobaa DB grows with errors BlockStoreAzure _delete_blocks failed for block
CVE-2026-57155 is a critical path traversal vulnerability in the OPNsense core firewall and routing platform prior to version 26.1.11. It arises from improper validation of a CSV country_code value used in constructing output filenames during GeoIP alias imports. An attacker with Firewall Alias Edit privileges can exploit this to write arbitrary files as root, potentially leading to full firewall compromise via cron job execution. The issue is fixed in version 26.1.11.
A denial of service vulnerability exists in FasterXML Jackson 1.x, specifically in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13. The vulnerability is triggered by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue. This can cause the application to become unresponsive or crash.
Koha Community's Koha software contains an OS command injection vulnerability in its Task Scheduler deletion functionality. Authenticated staff users with schedule task permissions can exploit this by injecting shell metacharacters in the jobid parameter, leading to arbitrary command execution as the application user. This vulnerability is fixed in Koha versions 24.11.20, 25.05.15, 25.11.09, 26.05.04, and the 26.11 development branch.
Adobe Photoshop Desktop contains a double free vulnerability (CWE-415) that could allow an attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.10 and 26.11.7. The CVSS 3.1 base score is 7.8, indicating high severity.
CVE-2026-97830 is a high-severity double free vulnerability in Windows Internet Information Services on Microsoft Windows 11 version 23H2. It allows an unauthorized attacker to cause a denial of service over a network by triggering the double free condition. The vulnerability affects multiple builds of Windows 11 23H2 prior to their respective fixed versions.
CVE-2026-88071 is a high-severity vulnerability in Microsoft Windows 11 version 23H2 involving a double free flaw in Windows Hyper-V. This flaw allows an authorized local attacker to elevate privileges. The vulnerability affects multiple builds of Windows 11 23H2 and has been officially fixed in several updates. No known exploits are reported in the wild.
CVE-2026-70115 is a use-after-free vulnerability in the Microsoft Windows Search Component affecting Windows 11 Version 24H2. It allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score and has been officially fixed by Microsoft in specific updates.
A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate of the file controllers/cas.go of the component Proxy Validation. Such manipulation of the argument pgtUrl leads to server-side request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 4.11.0 is able to address this issue. The name of the patch is 03c6c9aaa2eda5b085ce128ce0d60b34094efbd9/ada08ecd10cbf158f593dee23a8bab63efecf995. It is advisable to upgrade the affected component.
Frappe HR (hrms) versions before 16.11.0, including all 14.x and 15.x releases up to 15.64.3, have a missing authorization vulnerability in the expire_allocation method. This flaw allows authenticated users without HR roles to expire any employee's leave allocation by sending a specially crafted POST request, effectively zeroing out the targeted employee's remaining leave balance.
Frappe HR (hrms) versions before 16.11.0, including all 14.x and 15.x releases through 15.64.3, have a missing authorization vulnerability in the whitelisted get_account_and_amount method. This flaw allows authenticated users without HR roles to access payroll information of other employees by calling the method via the /api/method endpoint with enumerable Salary Slip or claim document names. The disclosed data includes net pay and balances for loans, advances, and claims. The vulnerability has a CVSS 4.0 score of 5.3, indicating medium severity.
A malicious file identified by the SHA-256 hash 8a34152174b8009549359c9dd2407bd93c80e7dc3d0dedebdf8df423ccbdeacf was observed by OffSeq Mirage honeypot sensors on October 11, 2026. This file was detected six times in attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in South Korea and Ukraine. Organizations should check this hash against their environments and security tools to detect potential compromise.
CVE-2026-107818 is a high-severity vulnerability in MariaDB server affecting multiple versions from 10.6.1 up to but not including 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. It involves external control of system or configuration settings via the mariadb.service unit using the /run/mysqld/wsrep-new-cluster file during service restart. A database user with FILE privilege and appropriate secure-file-priv settings could create this file and inject attacker-controlled environment variables, potentially compromising confidentiality, integrity, and availability. The issue is fixed in the stated versions.