{"action":"Upgrade pillow to 13.0.0 or later.","affected":[{"fixed":"13.0.0","introduced":"0"}],"component":"pillow","cve_ids":["CVE-2026-112902"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["13.0.0"],"ghsa_id":"GHSA-xvh5-g6gv-559v","id":"tcs_01M5JMBZWT9AYTKH6B5HD5FA33","modified_at":"2026-10-21T21:45:08.352742595Z","published_at":"2026-10-21T21:29:16Z","references":["https://osv.dev/vulnerability/GHSA-xvh5-g6gv-559v","https://github.com/python-pillow/Pillow/security/advisories/GHSA-xvh5-g6gv-559v","https://github.com/python-pillow/Pillow/commit/af56ace297b0991d02988fcc2ea933e4824b4fb3","https://github.com/python-pillow/Pillow","https://github.com/python-pillow/Pillow/releases/tag/13.0.0"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-xvh5-g6gv-559v","url":"https://osv.dev/vulnerability/GHSA-xvh5-g6gv-559v"}],"summary":"Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags"}