UBUNTU-CVE-2026-112404

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-112404

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112404.json

JSON Data

https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2026-112404

Upstream

CVE-2026-112404

Published

2026-10-19T22:17:00Z

Modified

2026-10-28T20:17:18Z

Severity

8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not verify that the required input row fits inside the row libtiff produced, while the strip path has this validation. Loading pixels from such a crafted TIFF can expose adjacent heap data in output pixels or crash the process. This issue is fixed in version 13.0.0.

References

Affected packages

Ubuntu:22.04:LTS

pillow

Package

Name: pillow
Purl: pkg:deb/ubuntu/pillow?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

8.*

8.1.2+dfsg-0.3

9.*

9.0.0-1

9.0.1-1

9.0.1-1build1

9.0.1-1ubuntu0.1

9.0.1-1ubuntu0.2

9.0.1-1ubuntu0.3

9.0.1-1ubuntu0.4

9.0.1-1ubuntu0.5

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "python3-pil",
            "binary_version": "9.0.1-1ubuntu0.5"
        },
        {
            "binary_name": "python3-pil.imagetk",
            "binary_version": "9.0.1-1ubuntu0.5"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112404.json"

Ubuntu:24.04:LTS

pillow

Package

Name: pillow
Purl: pkg:deb/ubuntu/pillow?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

10.*

10.0.0-1

10.1.0-1

10.2.0-1

10.2.0-1build1

10.2.0-1ubuntu1

10.2.0-1ubuntu1.2

10.2.0-1ubuntu1.3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "python3-pil",
            "binary_version": "10.2.0-1ubuntu1.3"
        },
        {
            "binary_name": "python3-pil.imagetk",
            "binary_version": "10.2.0-1ubuntu1.3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112404.json"

Ubuntu:26.04:LTS

pillow

Package

Name: pillow
Purl: pkg:deb/ubuntu/pillow?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

11.*

11.3.0-1ubuntu1

11.3.0-1ubuntu2

12.*

12.0.0-1ubuntu1

12.1.1-1ubuntu1

12.1.1-2ubuntu1

12.1.1-2ubuntu1.1

12.1.1-2ubuntu1.2

12.1.1-2ubuntu1.3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "python3-pil",
            "binary_version": "12.1.1-2ubuntu1.3"
        },
        {
            "binary_name": "python3-pil.imagetk",
            "binary_version": "12.1.1-2ubuntu1.3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112404.json"

Ubuntu:26.10

pillow

Package

Name: pillow
Purl: pkg:deb/ubuntu/pillow?arch=source&distro=stonking

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

12.*

12.1.1-2ubuntu1

12.3.0-1ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "python3-pil",
            "binary_version": "12.3.0-1ubuntu1"
        },
        {
            "binary_name": "python3-pil.imagetk",
            "binary_version": "12.3.0-1ubuntu1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112404.json"

Ubuntu:Pro:14.04:LTS

pillow

Package

Name: pillow
Purl: pkg:deb/ubuntu/pillow?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.2.1-1ubuntu2

2.2.1-2ubuntu1

2.2.1-3ubuntu2

2.2.1-3ubuntu3

2.2.1-3ubuntu4

2.2.1-3ubuntu6

2.3.0-1ubuntu1

2.3.0-1ubuntu2

2.3.0-1ubuntu3

2.3.0-1ubuntu3.2

2.3.0-1ubuntu3.3

2.3.0-1ubuntu3.4

2.3.0-1ubuntu3.4+esm1

2.3.0-1ubuntu3.4+esm2

2.3.0-1ubuntu3.4+esm3

2.3.0-1ubuntu3.4+esm4

2.3.0-1ubuntu3.4+esm5

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "python-imaging",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
        },
        {
            "binary_name": "python-imaging-compat",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
        },
        {
            "binary_name": "python-imaging-sane",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
        },
        {
            "binary_name": "python-imaging-tk",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
        },
        {
            "binary_name": "python-pil",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
        },
        {
            "binary_name": "python-pil.imagetk",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
        },
        {
            "binary_name": "python-sane",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
        },
        {
            "binary_name": "python3-imaging",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
        },
        {
            "binary_name": "python3-imaging-sane",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
        },
        {
            "binary_name": "python3-imaging-tk",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
        },
        {
            "binary_name": "python3-pil",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
        },
        {
            "binary_name": "python3-pil.imagetk",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
        },
        {
            "binary_name": "python3-sane",
            "binary_version": "2.3.0-1ubuntu3.4+esm5"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112404.json"

Ubuntu:Pro:16.04:LTS

pillow

Package

Name: pillow
Purl: pkg:deb/ubuntu/pillow?arch=source&distro=esm-infra%2Fxenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.9.0-1

3.*

3.0.0-1

3.0.0-1build1

3.1.0-1

3.1.1-1

3.1.2-0ubuntu1

3.1.2-0ubuntu1.1

3.1.2-0ubuntu1.3

3.1.2-0ubuntu1.4

3.1.2-0ubuntu1.5

3.1.2-0ubuntu1.6

3.1.2-0ubuntu1.6+esm1

3.1.2-0ubuntu1.6+esm2

3.1.2-0ubuntu1.6+esm3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "python-imaging",
            "binary_version": "3.1.2-0ubuntu1.6+esm3"
        },
        {
            "binary_name": "python-pil",
            "binary_version": "3.1.2-0ubuntu1.6+esm3"
        },
        {
            "binary_name": "python-pil.imagetk",
            "binary_version": "3.1.2-0ubuntu1.6+esm3"
        },
        {
            "binary_name": "python3-pil",
            "binary_version": "3.1.2-0ubuntu1.6+esm3"
        },
        {
            "binary_name": "python3-pil.imagetk",
            "binary_version": "3.1.2-0ubuntu1.6+esm3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112404.json"

Ubuntu:Pro:18.04:LTS

pillow

Package

Name: pillow
Purl: pkg:deb/ubuntu/pillow?arch=source&distro=esm-infra%2Fbionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.1.1-3build2

4.3.0-2ubuntu1

5.*

5.0.0-1

5.1.0-1

5.1.0-1ubuntu0.2

5.1.0-1ubuntu0.3

5.1.0-1ubuntu0.4

5.1.0-1ubuntu0.5

5.1.0-1ubuntu0.6

5.1.0-1ubuntu0.7

5.1.0-1ubuntu0.8

5.1.0-1ubuntu0.8+esm1

5.1.0-1ubuntu0.8+esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "python-pil",
            "binary_version": "5.1.0-1ubuntu0.8+esm2"
        },
        {
            "binary_name": "python-pil.imagetk",
            "binary_version": "5.1.0-1ubuntu0.8+esm2"
        },
        {
            "binary_name": "python3-pil",
            "binary_version": "5.1.0-1ubuntu0.8+esm2"
        },
        {
            "binary_name": "python3-pil.imagetk",
            "binary_version": "5.1.0-1ubuntu0.8+esm2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112404.json"

Ubuntu:Pro:20.04:LTS

pillow

Package

Name: pillow
Purl: pkg:deb/ubuntu/pillow?arch=source&distro=esm-infra%2Ffocal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.1.0-1

6.1.0-1build1

6.2.1-2

7.*

7.0.0-4

7.0.0-4build1

7.0.0-4ubuntu0.1

7.0.0-4ubuntu0.2

7.0.0-4ubuntu0.3

7.0.0-4ubuntu0.4

7.0.0-4ubuntu0.5

7.0.0-4ubuntu0.6

7.0.0-4ubuntu0.7

7.0.0-4ubuntu0.8

7.0.0-4ubuntu0.9

7.0.0-4ubuntu0.9+esm1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "python3-pil",
            "binary_version": "7.0.0-4ubuntu0.9+esm1"
        },
        {
            "binary_name": "python3-pil.imagetk",
            "binary_version": "7.0.0-4ubuntu0.9+esm1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112404.json"

pillow-python2

Package

Name: pillow-python2
Purl: pkg:deb/ubuntu/pillow-python2?arch=source&distro=esm-apps%2Ffocal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.2.1-3~build1

6.2.1-3

6.2.1-3ubuntu0.1~esm1

6.2.1-3ubuntu0.1~esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "python-pil",
            "binary_version": "6.2.1-3ubuntu0.1~esm2"
        },
        {
            "binary_name": "python-pil.imagetk",
            "binary_version": "6.2.1-3ubuntu0.1~esm2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-112404.json"