Threats tagged 'pysec-2026-4363'

Pillow versions up to 12.3.0 contain a vulnerability in the libtiff TIFF encoder where arguments passed to TIFFSetField() may not match the expected tag definitions. This can lead to invalid memory reads, potentially disclosing process memory or causing crashes when attacker-controlled image metadata is saved. The issue occurs when re-saving compressed TIFF images or converting images that preserve EXIF metadata into compressed TIFF output. The vulnerability is fixed in Pillow version 13.0.0.