{"id":"EM-20261113-L6Q0","url":"https://cyber.eventmonitor.net/incident/EM-20261113-L6Q0/pillow-vulnerability-cve-2026-128066/","type":"cve","title":"Pillow Vulnerability (CVE-2026-128066)","subtitle":"CVE-2026-128066","subject":"CVE-2026-128066","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-13T00:20:14.457Z","firstSignal":"2026-11-12T23:35:39.000Z","lastSignal":"2026-11-13T00:20:14.457Z","updated":"2026-11-13T00:40:17.050Z","revision":1,"life":[{"status":"Born","at":"2026-11-13T00:20:14.457Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-13T00:20:14.457Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-12T23:35:39.000Z","what":"First signal: C26 GitHub Advisory Database"},{"at":"2026-11-13T00:20:14.457Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261113-L6Q0 created."},{"at":"2026-11-13T00:20:14.457Z","what":"Severity raised to High by C6"}],"stages":[{"name":"Disclosed","at":"2026-11-13T00:20:14.457Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-13T00:20:14.457Z","detail":"CVSS 8.7"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-12T23:35:39.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":2,"title":"GHSA-wqgw-9xfh-qf2g / CVE-2026-128066: Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data","text":"pip:Pillow","url":"https://github.com/advisories/GHSA-wqgw-9xfh-qf2g"},{"at":"2026-11-13T00:20:14.457Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-128066 (CVSS 8.7)","text":"Pillow is a Python imaging library. From 1.0 through 12.3.0, ImageFileDirectory_v2.load() in src/PIL/TiffImagePlugin.py retains a separate bytes object for each out-of-line IFD tag value without limiting the total data read or preventing distinct tags from referencing the same file region. A small crafted TIFF or EXIF-bearing JPEG, PNG, WebP, or MPO can therefore cause memory use quadratic in the input size. TIFF and some JPEG paths trigger parsing during Image.open(), while other formats are exposed when EXIF is requested, including through getexif() or ImageOps.exif_transpose(). The…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128066"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-13T00:20:14.457","score":8.7,"severity":"HIGH","desc":"Pillow is a Python imaging library. From 1.0 through 12.3.0, ImageFileDirectory_v2.load() in src/PIL/TiffImagePlugin.py retains a separate bytes object for each out-of-line IFD tag value without limiting the total data read or preventing distinct tags from referencing the same file region. A small…","product":"","seen":1794530417050},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}