Threats tagged 'brew-aider-cve-2026-112897'

A vulnerability in Pillow's TIFF decoding allows reading uninitialized heap memory as image pixels when opening crafted TIFF files with short JPEG strips. This occurs because the buffer used to decode strips is reallocated but not initialized, and libtiff's JPEG codec returns the full strip size even if fewer rows are decoded. The leftover memory is exposed as pixel data without error or warning.