Mmastodon TechnologyCybersecurity first seen 3 d ago, last 3 d ago, peak #3

Pillow hit by medium-severity heap use-after-free flaw

Original: 🚨 EUVD-2026-104632 📊 Score: 5.9/10 (CVSS v3.1) 📦 Product: Pillow 🏢 Vendor: python-pillow 📅 Published: 2026-10-19 | Updat

A new vulnerability, EUVD-2026-104632, has been published affecting Pillow, the widely used Python imaging library. Versions 11.3.0 through 13.0.0 contain a heap use-after-free bug that triggers when libtiff rejects a tag during TIFF encoding. The flaw carries a CVSS v3.1 score of 5.9 out of 10, marking it as medium severity. It was published on 20 October 2026, and security teams running affected versions are being urged to review and patch.

Why now: Security teams monitor new vulnerability disclosures in widely used open-source libraries like Pillow.

Pillowpython-pillowlibtiff

Open on mastodon →

Evidence

• 🚨 EUVD-2026-104632 📊 Score: 5.9/10 (CVSS v3.1) 📦 Product: Pillow 🏢 Vendor: python-pillow 📅 Published: 2026-10-19 | Updated: 2026-10-20 📝 Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF… · EUVD_Bot · 1

API: https://socialmediatrends-api.osmike.com/v1/trends/3015951