CVE-2026-112393

Affected versions of the Pillow package are vulnerable to Heap-based Buffer Overflow due to incorrect buffer size calculation when writing TIFF data to in-memory targets. The `_tiffWriteProc` function in `src/libImaging/TiffDecode.c` sizes its `realloc()` call using `state->size + size` instead of the actual write position `state->loc + size`, so when libtiff seeks past the end of the current buffer (as it does while writing directory entries and out-of-line tag values) and then writes, the resulting `memcpy` can copy data past the end of the reallocated heap block; the same flaw also leaves the skipped-over padding bytes uninitialized, leaking stale heap memory into the output file. An attacker who can get an application to open an attacker-supplied TIFF (or one with a crafted ImageDescription, DocumentName, XMP packet, or embedded ICC profile) and re-save it as TIFF to a non-file target such as `io.BytesIO` can trigger an out-of-bounds heap write using attacker-controlled tag data, causing a crash via heap corruption, disclosure of adjacent heap memory in the generated file, and, as demonstrated, remote code execution when combined with a separate heap address disclosure.