A memory denial-of-service vulnerability exists in Pillow's TIFF and EXIF IFD parsing due to overlapping tag data references. Crafted image files can cause Pillow to allocate memory many times larger than the file size during parsing, leading to process crashes or stalls. This affects TIFF, JPEG, PNG, WebP, and MPO images. The vulnerability has been present since Pillow 1.0 and is fixed in version 13.0.0.