Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not verify that the required input row fits inside the row libtiff produced, while the strip path has this validation. Loading pixels from such a crafted TIFF can expose adjacent heap data in output pixels or crash the process. This issue is fixed in version 13.0.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can
    read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and
    libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not
    verify that the required input row fits inside the row libtiff produced, while the strip path has this
    validation. Loading pixels from such a crafted TIFF can expose adjacent heap data in output pixels or
    crash the process. This issue is fixed in version 13.0.0. (CVE-2026-112404)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can     read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and     libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not     verify that the required input row fits inside the row libtiff produced, while the strip path has this     validation. Loading pixels from such a crafted TIFF can expose adjacent heap data in output pixels or     crash the process. This issue is fixed in version 13.0.0. (CVE-2026-112404)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
476407	SCA: security update for Pillow (GHSA-c6hw-5grf-ff96)	Tenable Cloud Security	SCA Checks	Local	high
476407	SCA: security update for Pillow (GHSA-c6hw-5grf-ff96)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
367600	Linux Distros Unpatched Vulnerability : CVE-2026-112404	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-112404

high

Tenable Plugins

high

high

high