Skip to content
OpenAdvisories
High ALAS2-2026-4107 1 CVE

Important: python-pillow security update (Amazon Linux 2)

Published Nov 12, 2026 · Updated Nov 12, 2026

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-112902: A flaw was found in Pillow. When saving an image in the TIFF format, Pillow incorrectly forwards unknown metadata tags to the underlying image processing library. A remote attacker could exploit this flaw by providing a specially crafted image containing malicious metadata to an application that processes and re-saves it. Successful exploitation allows the attacker to read out-of-bounds memory, leading to the disclosure of sensitive process memory or causing the application to crash, resulting in a Denial of Service (DoS).

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 python-pillow 0:2.0.0-23.gitd1c6db8.amzn2.0.22
Amazon Linux · 2 python-pillow-debuginfo 0:2.0.0-23.gitd1c6db8.amzn2.0.22
Amazon Linux · 2 python-pillow-devel 0:2.0.0-23.gitd1c6db8.amzn2.0.22
Amazon Linux · 2 python-pillow-doc 0:2.0.0-23.gitd1c6db8.amzn2.0.22
Amazon Linux · 2 python-pillow-sane 0:2.0.0-23.gitd1c6db8.amzn2.0.22
Amazon Linux · 2 python-pillow-tk 0:2.0.0-23.gitd1c6db8.amzn2.0.22

Vulnerabilities 1

  • High 8.3

    Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags

    Pillow is a Python imaging library. In versions through 12.3.0, the libtiff TIFF encoder can pass arguments to  TIFFSetField()  that do not match libtiff’s definition of the corresponding tag. When an application saves attacker-controlled image metadata throu…

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-112902.html