[ Vendor · 38 CVEs ]
python-pillow
CVEs affecting python-pillow published in the last 30 days, plus any python-pillow CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114501 | 21 Oct 2026 | CVSS 6.3 | python-pillow PillowPillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from… | |
| CVE-2026-96778 | 21 Oct 2026 | CVSS 7.7 | Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills bufferPillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a… | Fix |
| CVE-2026-96638 | 21 Oct 2026 | CVSS 6.5 | Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute modePillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta… | Fix |
| CVE-2026-96639 | 21 Oct 2026 | CVSS 9.8 | Pillow multi-frame loaders can reuse stale native image storage after mode transitionsPillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame… | Fix |
| CVE-2026-96640 | 21 Oct 2026 | CVSS 8.2 | Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustionPillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a… | Fix |
| CVE-2026-96641 | 21 Oct 2026 | CVSS 6.5 | Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromisePillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/_imaging.c checks positive glyph advances against INT_MAX… | Fix |
| CVE-2026-96642 | 21 Oct 2026 | CVSS 7.1 | Pillow: TarIO negative size field causes infinite CPU-spin loopPillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a… | Fix |
| CVE-2026-96643 | 21 Oct 2026 | CVSS 7.1 | Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic timePillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it… | Fix |
| CVE-2026-96644 | 21 Oct 2026 | CVSS 7.1 | Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native… | Fix |
| CVE-2026-96636 | 21 Oct 2026 | CVSS 6.5 | Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DCX frames and replace… | Fix |
| CVE-2026-96637 | 21 Oct 2026 | CVSS 7.1 | Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoSPillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and… | Fix |
| CVE-2026-112898 | 19 Oct 2026 | CVSS 6.9 | Pillow: Image.quantize() with empty palette leaks uninitialized stack memoryPillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty… | Fix |
| CVE-2026-112900 | 19 Oct 2026 | CVSS 9.2 | Pillow: Argument Injection in Ghostscript call, potentially leading into RCEPillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input… | Fix |
| CVE-2026-112901 | 19 Oct 2026 | CVSS 6.9 | Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutesPillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In… | Fix |
| CVE-2026-112892 | 19 Oct 2026 | CVSS 8.7 | Pillow: MSP RLE decoder expands a tiny file into unbounded memoryPillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The… | Fix |
| CVE-2026-112893 | 19 Oct 2026 | CVSS 8.2 | Pillow: Invalid free in FreeType glyph rendering when a stroker is activePillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active… | Fix |
| CVE-2026-112894 | 19 Oct 2026 | CVSS 8.7 | Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames… | Fix |
| CVE-2026-112895 | 19 Oct 2026 | CVSS 8.7 | Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation… | Fix |
| CVE-2026-112896 | 19 Oct 2026 | CVSS 8.8 | Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds readPillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane… | Fix |
| CVE-2026-112897 | 19 Oct 2026 | CVSS 8.7 | Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG stripsPillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of… | Fix |
| CVE-2026-112405 | 19 Oct 2026 | CVSS 8.7 | Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first… | Fix |
| CVE-2026-112406 | 19 Oct 2026 | CVSS 8.7 | Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cyclePillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages()… | Fix |
| CVE-2026-112891 | 19 Oct 2026 | CVSS 6.9 | Pillow: Quadratic GIF comment copying during savePillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment… | Fix |
| CVE-2026-112398 | 19 Oct 2026 | CVSS 9.2 | python-pillow PillowPillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile… | |
| CVE-2026-112399 | 19 Oct 2026 | CVSS 8.7 | Pillow: APNG background disposal allocates full canvas before decompression bomb checkPillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying… | Fix |
| CVE-2026-112400 | 19 Oct 2026 | CVSS 8.7 | Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoSPillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In… | Fix |
| CVE-2026-112401 | 19 Oct 2026 | CVSS 6.9 | Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile._seek()… | Fix |
| CVE-2026-112402 | 19 Oct 2026 | CVSS 8.7 | Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transformPillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation… | Fix |
| CVE-2026-112403 | 19 Oct 2026 | CVSS 9.2 | Pillow: Heap buffer overflow in ImagingJpegDecodePillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft… | Fix |
| CVE-2026-112404 | 19 Oct 2026 | CVSS 8.8 | Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixelsPillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff… | Fix |
| CVE-2026-112392 | 19 Oct 2026 | CVSS 8.2 | Pillow: NULL dereference in ImagingExpand via rank filters on zero-size imagesPillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image… | Fix |
| CVE-2026-112396 | 19 Oct 2026 | CVSS 5.9 | Pillow: Heap use-after-free when encoding TIFF to an in-memory bufferPillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to… | Fix |
| CVE-2026-112397 | 19 Oct 2026 | CVSS 8.7 | Pillow: Out-of-bounds access in _imagingmorph on a zero-width imagePillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width… | Fix |
| CVE-2026-112390 | 19 Oct 2026 | CVSS 8.2 | Pillow: Infinite loop in MIC n_frames when the embedded TIFFPillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image… | Fix |
| CVE-2026-112391 | 19 Oct 2026 | CVSS 6.3 | Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse without a limit while reading nested PDF… | Fix |
| CVE-2026-112393 | 19 Oct 2026 | CVSS 9.2 | Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIOPillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when… | Fix |
| CVE-2026-112394 | 19 Oct 2026 | CVSS 6.3 | Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer sizePillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can read past the end of an input buffer. ImagingRawDecode… | Fix |
| CVE-2026-112395 | 19 Oct 2026 | CVSS 6.5 | Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte… | Fix |