CVE-2021-25291

Vulnerability

Description

The flaw resides in the TiffDecode.c file of Pillow, the Python Imaging Library fork. When decoding a TIFF image that uses tiles (as opposed to strips), the function TiffreadRGBATile does not properly validate tile boundary coordinates [1]. An attacker can craft a malicious TIFF file with invalid tile offsets or dimensions, leading to an out-of-bounds read (OOB read) [1][2].

Exploitation

Conditions

Exploitation requires the attacker to supply a specially crafted TIFF file to an application that uses Pillow to decode it. No special privileges or network position is necessary beyond the ability to deliver the file (e.g., via upload, email, or download). The vulnerability is triggered during the decoding process, meaning user interaction such as opening or processing the image is sufficient [2].

Impact

An out-of-bounds read can leak sensitive heap memory contents that may include data from other parts of the application, potentially aiding in further exploitation. In some cases, this memory access violation can lead to a denial of service (application crash) [1][2]. The severity is rated as high given the potential for information disclosure and system instability.

Mitigation

The vulnerability was patched in Pillow version 8.1.1 [1][3]. Users are strongly advised to upgrade to the latest release. No workaround is known, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of this writing.