Detections
Analytics

SCA: security update for Pillow (GHSA-332p-7hrc-92wf)

critical Tenable Cloud Security Plugin ID 476579

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-
 heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a
 usable fileno(), such as BytesIO. The callback sizes its allocation from the prior buffer size instead of
 the current write position, allowing an attacker-controlled out-of-line TIFF tag or retained ICC profile
 to be copied beyond the allocation after libtiff seeks forward. This overflow can crash the process and
 may allow code execution. Independently, unwritten alignment gaps in compressed TIFF output larger than 64
 KiB can disclose stale heap bytes without a crafted tag. File paths and targets with real file descriptors
 are unaffected. This issue is fixed in version 13.0.0. (CVE-2026-112393)

Solution

Update the Pillow library and its related packages to version 13.0.0 or later.

See Also

https://github.com/advisories/GHSA-332p-7hrc-92wf

Plugin Details

Severity: Critical

ID: 476579

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/22/2026

Updated: 10/22/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.46

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-112393

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.2

Threat Score: 7.2

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/21/2026

Vulnerability Publication Date: 10/19/2026

Reference Information

CVE: CVE-2026-112393

cwe: CWE-122