Function Call With Incorrect Argument Type Affecting pillow package, versions [,13.0.0)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-PILLOW-21430900
- published22 Oct 2026
- disclosed21 Oct 2026
- creditNicholas Carlini
Introduced: 21 Oct 2026
NewCVE-2026-112902 (opens in a new tab)How to fix?
Upgrade Pillow to version 13.0.0 or higher.
Overview
Pillow is a PIL (Python Imaging Library) fork.
Affected versions of this package are vulnerable to Function Call With Incorrect Argument Type via insufficient validation of TIFF tag values before passing them to TIFFSetField in the libtiff encoder. When saving a TIFF image, tag values supplied by the caller are forwarded to TIFFSetField without verifying that their type, count, or array length matches libtiff's own field definition for that tag. An attacker who can influence the TIFF tags written during a save operation can trigger an out-of-bounds read or a crash, leading to information disclosure or denial of service.