CVE-2026-112902

Affected versions of the Pillow package are vulnerable to Function Call With Incorrect Argument Type (CWE-686) due to `PyImaging_LibTiffEncoderNew()` deciding the argument shape passed to libtiff's variadic `TIFFSetField()` from the Python value's type rather than from libtiff's own field definition. The function calls `ImagingLibTiffMergeFieldInfo()` assuming it overrides how libtiff interprets tag arguments, but `TIFFMergeFieldInfo()` leaves libtiff's built-in definitions intact for tags it already knows, so a scalar integer tag such as `DNGPrivateData` (50740) is read by libtiff as a `(count, pointer)` pair, and a tag such as `ActiveArea` (50829) is read as a raw pointer, consuming vararg slots Pillow never populated. An attacker can craft a small TIFF file containing specially chosen tag entries so that, when the victim application opens and re-saves it through `im.save(fp, "TIFF")`, Pillow's libtiff writer copies an attacker-controlled number of bytes from uninitialized memory into the output file (resulting in Information Disclosure of process memory and ASLR bypass) or dereferences an attacker-controlled address, crashing the worker process via SIGSEGV (Denial of Service).