CVE-2026-128067 is a heap buffer overflow vulnerability in the Pillow library when saving TIFF images using libtiff with certain metadata tags that override image size. The flaw occurs because Pillow allows image metadata tags such as ImageWidth, ImageLength, and SamplesPerPixel to override the actual image dimensions used to allocate buffers, leading libtiff to read or write beyond the allocated heap buffer. This can cause memory corruption, crashes, or leakage of server process memory into saved TIFF files. The vulnerability affects applications that save TIFF images with compression enabled (other than raw) and preserve or merge metadata from uploaded images. The issue has been present since Pillow 2.3.0 and 8.4.0 for different metadata handling routes.