Bundled libtiff 4.7.1 is vulnerable to CVE-2026-4775 (integer overflow in putcontig8bitYCbCr44tile)

## Summary Pillow 12.1.1 and 12.2.0 bundle libtiff 4.7.1 in `pillow.libs/`, which contains the vulnerable code from CVE-2026-4775 — a signed integer overflow in `putcontig8bitYCbCr44tile` (and related functions) in `tif_getimage.c` that can cause an out-of-bounds heap write via a specially crafted TIFF file, potentially resulting in denial of service or arbitrary code execution. ## Proof **1. Pillow bundles its own libtiff and ignores the system library** ``` $ python -c "from PIL import features; print(features.version('libtiff'))" 4.7.1 $ ldd /usr/local/lib/python3.11/site-packages/PIL/*.so | grep tiff libtiff-76d51d59.so.6.2.0 => .../site-packages/pillow.libs/libtiff-76d51d59.so.6.2.0 ``` **2. The official libtiff 4.7.1 tarball contains the vulnerable code** Downloaded directly from https://download.osgeo.org/libtiff/tiff-4.7.1.tar.gz and checked `libtiff/tif_getimage.c`: ``` 2219: int32_t incr = 3 * w + 4 * toskew; ← vulnerable 2359: int32_t incr = 2 * toskew + w; ← vulnerable 2515: int32_t incr = 2 * toskew + w; ← vulnerable ``` **3. The fix postdates the 4.7.1 release** The upstream fix is commit [`782a11d6`](https://gitlab.com/libtiff/libtiff/-/commit/782a11d6b5b61c6dc21e714950a4af5bf89f023c), authored **February 22, 2026** — after 4.7.1 shipped. The Debian security team also describes their fix as a "backport", confirming it was not present in upstream 4.7.1. The fix changes `int32_t` to `const tmsize_t` with explicit casts to prevent overflow: ```diff - int32_t incr = 3 * w + 4 * toskew; + const tmsize_t incr = 3 * (tmsize_t)w + 4 * (tmsize_t)toskew; ``` ## Impact Any application using Pillow to open untrusted TIFF files is exposed. `Image.open()` on a crafted TIFF file triggers the vulnerable code path in the bundled libtiff. Upgrading the system libtiff package does not help — Pillow loads its own copy from `pillow.libs/` regardless. ## Suggested Fix Update the vendored libtiff to a commit that includes `782a11d6` (i.e., post-4.7.1 main branch), or apply the three-line patch to the vendored copy before the next wheel build. ## References - CVE: CVE-2026-4775 - Upstream libtiff fix: https://gitlab.com/libtiff/libtiff/-/commit/782a11d6b5b61c6dc21e714950a4af5bf89f023c - Upstream libtiff issue: https://gitlab.com/libtiff/libtiff/-/issues/787 - Debian security advisory: DSA-6303-1