TIFF build and patch provenance for Pillow 12.3.0 Windows wheel

[fgihaga]

Hello Pillow maintainers,

We are reviewing the native-library provenance of the following official Pillow wheel:

Artifact: pillow-12.3.0-cp313-cp313-win_amd64.whl

SHA-256: 1cca606cd25738df4ed873d5ad46bbdb3d83b5cbca291f6b4ff13a4df6b0bbe8

The embedded SBOM identifies TIFF 4.7.1 and a cherry-picked fix for CVE-2026-4775.

Could you help confirm:

1. The exact libtiff source revision, build configuration, and patch set included in this wheel.
2. Whether the build includes the complete corrections for CVE-2026-12912, including MR !873 and the MR !883 follow-up, or equivalent fixes.
3. Whether the build includes the correction for CVE-2026-36849, or an equivalent fix.
4. Whether a public build record, source manifest, or other provenance evidence links these fixes to this specific wheel.

We have not established that the wheel is vulnerable. We are seeking artifact-specific evidence of the included fixes and any relevant configuration limitations.

Links to existing public records would be sufficient. No artifact transfer is needed.

Thank you for your help.

[radarhere]

Hi.
1 As you say, we used libtiff 4.7.1. We applied https://gitlab.com/libtiff/libtiff/-/commit/782a11d6 against it. If you would like to know about the settings used when building libtiff, see https://github.com/radarhere/Pillow/blob/e9545fe24f30f4e8e2be556eae045cfb5f29f9e7/.github/workflows/wheels-dependencies.sh#L273-L284 and https://github.com/multi-build/multibuild/blob/f66d563dc6d2c8db1fa1f77cfadd583a93ecf20c/library_builders.sh#L195-L200. For WIndows, see https://github.com/radarhere/Pillow/blob/e9545fe24f30f4e8e2be556eae045cfb5f29f9e7/winbuild/build_prepare.py#L203-L231
2, 3 and 4. Pillow 12.3.0 wheels only include the one libtiff security patch.

Be aware that Pillow 13.0.0 is due to be released next week with libtiff 4.7.2, without any patch.

[radarhere]

Pillow 13.0.0 has now been released.