A heap buffer overflow vulnerability exists in Pillow when saving TIFF images using libtiff with certain metadata tags that override the image size. This can cause the encoder to read or write beyond the allocated buffer, potentially leading to memory disclosure or process crashes. The flaw arises because Pillow merges image metadata tags such as ImageWidth, ImageLength, and SamplesPerPixel from EXIF or TIFF info without proper validation against the actual image size. This affects TIFF saving with compression enabled (other than raw) and has been fixed in Pillow version 13.0.0.