1 vulnerability across 1 product scored HIGH or above on November 13, 2026.

  • 🟠 HIGH: 1

🟠 [HIGH] python-pillow/pillow

1 CVE | CVSS 4.0: 8.4 | AAS 9.2

  • cpe:2.3:a:python-pillow:pillow:*:*:*:*:*:*:*:* (>= 2.3.0, < 12.4.0)

Pillow, the widely used Python imaging library, is affected by one high-severity vulnerability (CVE-2026-128067, CVSS 8.4) involving a heap buffer overflow in the TIFF image encoder. Versions 2.3.0 through 12.3.0 are vulnerable when saving compressed TIFF images via libtiff, where attacker-controlled image geometry tags can cause the encoder to write beyond the allocated scanline buffer, potentially enabling code execution. Any Python application or service that processes and re-saves TIFF images using Pillow should upgrade immediately to a patched release and review the vendor commit linked in the advisory.

Vendor Advisory