Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.
A high-severity vulnerability (CVE-2026-112897) affects the Pillow Python imaging library versions from 5.3.0 up to but not including 13.0.0. The vulnerability has a CVSS 4.0 base score of 8.7, indicating a significant security risk. The flaw allows for a high impact on confidentiality without requiring privileges or user interaction. Multiple Ubuntu package versions are listed as affected. No public exploits or vendor patch information are provided in the data.
A high-severity vulnerability (CVE-2026-112895) affects the Pillow Python imaging library versions from 5.1.0 up to but not including 13.0.0. The vulnerability has a CVSS 4.0 base score of 8.7, indicating a significant security risk. The affected versions include multiple Ubuntu package builds of Pillow. No public exploits or vendor patch information are provided in the data.
A high-severity vulnerability (CVE-2026-112894) affects the Pillow Python imaging library versions from 5.1.0 up to 13.0.0. The vulnerability has a CVSS 4.0 score of 8.7, indicating a significant security risk. The flaw allows for a high impact without requiring privileges or user interaction. Multiple Ubuntu package versions of Pillow are affected. No public exploits or patches are currently documented in the provided data.
A high-severity vulnerability (CVE-2026-112406) affects the Pillow Python imaging library versions from 5.1.0 up to 13.0.0. The vulnerability has a CVSS 4.0 base score of 8.7, indicating a significant security risk. The flaw allows an attacker to cause a high impact without requiring privileges, user interaction, or vector complexity. Multiple Ubuntu package versions of Pillow are affected. No public exploits or vendor patch information are provided in the input data.
CVE-2026-112405 is a high-severity vulnerability affecting the Pillow Python imaging library versions from 12.0.0 up to but not including 13.0.0. The vulnerability has a CVSS 4.0 base score of 8.7, indicating a significant security risk. The flaw allows for a high impact without requiring privileges, user interaction, or complex attack conditions. No public exploits or known active exploitation have been reported. The affected versions include multiple Ubuntu package builds of Pillow. No patch or remediation details are provided in the available data.
A vulnerability exists in the Pillow Python imaging library affecting versions from 5.4.0 up to but not including 13.0.0. The CVSS 4.0 base score is 6.9, indicating a medium severity issue. The vulnerability allows an attacker to cause a limited impact without requiring privileges or user interaction. There are no known exploits in the wild, and no patch or remediation details are provided in the available data.
A vulnerability exists in the Pillow Python imaging library affecting versions from 11.3.0 up to but not including 13.0.0. The flaw has a CVSS 3.1 base score of 5.9, indicating a medium severity issue primarily impacting availability. The vulnerability does not affect confidentiality or integrity but can cause denial of service. No public exploits or known active exploitation have been reported. The affected versions include various Ubuntu package builds of Pillow. No explicit patch or remediation details are provided in the available data.
A high-severity vulnerability (CVE-2026-112258) exists in GIMP where the XCF loader can leave a dangling pointer. This flaw affects multiple specific versions of GIMP and has a CVSS score of 7.8, indicating significant impact on confidentiality, integrity, and availability. The vulnerability requires local access and user interaction to exploit. No public exploits or known active exploitation have been reported.
A high-severity vulnerability (CVE-2026-112257) exists in GIMP affecting multiple specific versions. The flaw is related to the PSD thumbnail resource loader, potentially allowing an attacker to cause significant confidentiality, integrity, and availability impacts. The vulnerability requires local access and user interaction to exploit.
## Summary
A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 (ColorMap) with **768 SHORT values**: three zero-filled planes of 256 entries each. No Python object is forged and no metadata is injected after loading.
Pillow's TIFF encoder allocates **768 × 2 = 1536 bytes**, then passes three plane pointers separated by 256 SHORT entries to libtiff. With `BitsPerSample = 16`, libtiff instead expects **65536 SHORT values per plane** and attempts a **131072-byte read** from a plane pointer. Existing ASAN observations identify a heap-buffer-overflow READ crossing the 1536-byte allocation made in `PyImaging_LibTiffEncoderNew`.
The malformed ColorMap need not be a valid palette for this grayscale image. The issue is that accepted metadata is forwarded on save without reconciling the fixed plane extent with the effective sample depth. Opening/loading alone is not the demonstrated fault; the encoder path is required.
## Impact and prerequisites
An application must accept the input, retain the relevant TIFF metadata, and invoke the libtiff-backed TIFF save path. The observed consequence is an out-of-bounds read and ASAN termination. Process-memory exposure during encoding is a potential consequence, **not demonstrated by extracting arbitrary heap contents in this report**. No arbitrary read primitive, full memory-disclosure chain, code execution, address-space bypass, or cross-process effect is claimed.
The 131072-byte attempted copy is not the number of bytes proven disclosed. This report does not run a synthetic-canary serializer or collect an unsanitized encoded output.
## Tested environment and limits of the evidence
The existing observations were recorded on August 30, 2026, with **CPython 3.11.8 on macOS ARM64**, using the unmodified official **Pillow 12.3.0** wheel and its bundled **libtiff 4.7.1**:
- Wheel: `pillow-12.3.0-cp311-cp311-macosx_11_0_arm64.whl`
- Wheel size: `4785266` bytes
- Wheel SHA-256: `37d6d0a00072fd2948eb22bce7e1475f34569d90c87c59f7a2ec59541b77f7a6`
- Pillow source revision: `bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d`
- Bundled libtiff SHA-256: `e8988717b7470394a47d5ccd343130796b24ee70b6d885d3818e0e0b53238be1`
Apple's ASAN runtime was injected at process startup. This is **not an ASAN-rebuilt Pillow wheel**; allocation/memcpy interception detects the reported boundary violation, but the wheel's native instructions are not comprehensively instrumented.
Only this concrete full-package environment is established here. No affected-version range, current development-branch result, or patched release is asserted. Severity is **Unknown**; no CVSS score is proposed.
Separate earlier evidence reached the original Pillow 8.0.1 encoder constructor compiled as a component against a modern Python/libtiff environment. **That was not a complete Pillow 8.0.1 installation** and does not establish the historical package's full runtime behavior. It is not part of this reproducer or an affected-version range.
## Observed evidence and controls
The earlier integration harness performed the natural sequence `Image.open(BytesIO(input))`, `image.load()`, then `image.save(BytesIO(), format="TIFF")`, without replacing the image's metadata. Each case was recorded three times:
| Original fixture | Bytes | Recorded result |
| --- | ---: | --- |
| `colormap16` | 1685 | Loaded as `I;16`; save terminated with ASAN exit 86, READ of size 131072 crossing a 1536-byte heap region (3/3). |
| `colormap8` | 1684 | Same fixed ColorMap, but 8-bit samples; save succeeded and retained SHORT/count 768 (3/3). |
| `colormap_absent` | 137 | Same 16-bit geometry without ColorMap; save succeeded (3/3). |
Address-free summary of the recorded native diagnostic:
```text
AddressSanitizer: heap-buffer-overflow
READ of size 131072
0 bytes after 1536-byte region
Copy path: memcpy -> _TIFFmemcpy -> setByteArray -> _TIFFsetShortArrayExt
-> _TIFFVSetField -> TIFFVSetField -> ImagingLibTiffSetField
-> PyImaging_LibTiffEncoderNew
Allocation: calloc -> PyImaging_LibTiffEncoderNew
```
Input SHA-256 values (also enforced inside the script):
- `colormap16`: `5f38e0ead90b97949fb0c98c63f9c68d00ba9181db6631ecb8927376dcc75f4d`
- `colormap8`: `fdb26d9135549ed44824901985086c5ee4f06515699ca3291e498c523935405c`
- `colormap_absent`: `bd54979624f3ffb713342e0458caff9e17c477f940cda2f0960feebfabbc9556`
## Root cause and source references
- [Pillow `src/encode.c`, lines 870–899, pinned revision](https://github.com/python-pillow/Pillow/blob/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d/src/encode.c#L870): the ColorMap tuple must contain exactly 768 entries; a 1536-byte allocation is passed with a fixed stride of 256. The check does not reconcile that extent with `BitsPerSample`.
- [Pillow `src/PIL/TiffImagePlugin.py`, lines 1944–19
Red Hat build of MicroShift is Red Hat's light-weight Kubernetes
orchestration solution designed for edge device deployments and is built
from the edge capabilities of Red Hat OpenShift Container Platform.
MicroShift is an application that is deployed on top of Red Hat Enterprise
Linux devices at the edge, providing an efficient way to operate
single-node clusters in these low-resource environments.
This advisory contains the RPM packages for Red Hat build of MicroShift
4.16.73. Read the following advisory for the container images for this
release:
https://access.redhat.com/errata/RHSA-2026:77616
Security Fix(es):
* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive
recursion in Unmarshal (CVE-2026-33818)
* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME
header (CVE-2026-42504)
* html/template: golang: Go html/template: Cross-Site Scripting via
pathological input (CVE-2026-56858)
* encoding/xml: golang: Go: Denial of Service via XML decoding recursion
depth issue (CVE-2026-56859)
* net/url: golang: golang net/url: Denial of Service from quadratic
complexity in path resolution (CVE-2026-56860)
* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite
KeyUpdate messages (CVE-2026-56862)
All Red Hat build of MicroShift 4.16 users are advised to use these updated
packages and images when they are available in the RPM repository.
A medium severity vulnerability (CVE-2026-112395) affects the Pillow Python imaging library versions from 8.2.0 up to but not including 13.0.0. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a network attack vector with low complexity and no privileges or user interaction required. The impact includes limited confidentiality loss and availability impact, with no integrity impact reported. The vulnerability affects multiple Ubuntu package versions of Pillow. No public exploits or known active exploitation have been reported. Patch status is not confirmed from the provided data.
CVE-2026-112391 is a high-severity vulnerability affecting the Pillow Python imaging library versions from 5.1.0 up to 13.0.0. The vulnerability impacts availability but does not affect confidentiality or integrity. It has a CVSS 3.1 base score of 7.5. Specific affected Ubuntu package versions are listed, but no patch or remediation details are provided in the source data.
A high-severity vulnerability (CVE-2026-112390) affects the Pillow Python imaging library versions from 7.2.0 up to but not including 13.0.0. The vulnerability has a CVSS score of 7.5, indicating a network exploitable issue with no required privileges or user interaction, causing a high impact on availability. No known exploits are reported in the wild. The affected versions include several Ubuntu package versions of Pillow, but no specific technical details about the nature of the vulnerability are provided.
A medium severity vulnerability (CVE-2026-112300) has been identified in DiffSK configobj affecting versions up to 5.0.9. The flaw does not impact confidentiality or integrity but can cause a denial of service. No public exploits or active exploitation in the wild are known at this time.
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl contain a vulnerability that causes quadratic CPU usage during JSON parsing. The issue arises because the decoder revalidates the remaining buffer for each value in incremental parsing, leading to excessive CPU consumption when processing non-ASCII JSON strings. This can tie up the process for seconds when handling about a megabyte of such input.
Cpanel::JSON::XS versions before 4.80 for Perl have a memory leak vulnerability where decoded arguments of a tagged value are leaked if the THAW method dies during decode_tag. This occurs because the decoded class name and argument array are only released after THAW returns, so an error in THAW causes the decoded argument structure to remain allocated. An attacker can exploit this by sending specially crafted documents that cause repeated errors, leading to memory exhaustion in the process.
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl improperly accept malformed UTF-8 in bare hash keys when using allow_barekey in decode_hv. This causes malformed UTF-8, control bytes, and backslashes to be stored without validation, leading to errors in later operations such as case conversion or re-encoding of the hash.