Pillow
Monthly
Pillow versions 11.0.0 through 12.x (fixed in 13.0.0) can reuse a stale native ImagingCore buffer when a multi-frame image is advanced to a later frame whose pixel mode widens from a narrow format to RGB or CMYK, or whose dimensions change, producing native out-of-bounds writes and crashes; the MPO path can additionally over-read memory and, on specific runtime/heap profiles, achieve command execution. Exploitation requires the application to open an attacker-supplied PSD, MPO, DCX, or MIC file and actually seek/load past the first frame, since reading only the initial frame does not trigger the bug; no credentials or user interaction are needed in an automated image-processing pipeline. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, although the 9.8 CVSS and the trivially craftable file format make weaponization plausible for any service that validates or thumbnails multi-frame uploads.
Memory exhaustion in Pillow's SPIDER image plugin lets an attacker-supplied multi-frame .spider stack file bypass the library's decompression-bomb guard and drive allocations of several gigabytes. The flaw lives in SpiderImageFile.seek(), which reparses a later frame and overwrites self._size without re-running Image._decompression_bomb_check(), so a tiny file with a benign first frame passes Image.open() and then declares enormous dimensions in a later mode-F frame; loading that frame consumes roughly four bytes per attacker-declared pixel. All Pillow releases prior to 13.0.0 that parse SPIDER stacks are affected, and exploitation requires the application to open an untrusted multi-frame SPIDER file and then seek past frame 0 - a niche, passive-interaction path consistent with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor patch is 13.0.0.
Denial of service in Pillow 11.0.0 through 12.x lets an attacker-supplied PNG file consume unbounded CPU time when the application parses its EXIF metadata. Because PngImagePlugin accepts an uncapped eXIf chunk, a file stuffed with repeated six-byte 'Exif\x00\x00' headers causes Exif.load() to make a new shrinking copy of the buffer on every loop iteration, producing quadratic work that is triggered through routine calls such as Image.getexif(), Image._getexif(), or ImageOps.exif_transpose() - the latter backing many photo-upload auto-rotation workflows. The CVSS 4.0 score is 7.1 (assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), reflecting a pure availability impact with no confidentiality or integrity loss; no public exploit code or CISA KEV entry was identified at time of analysis, and a vendor fix ships in 13.0.0.
Denial of service in Pillow's legacy TarIO parser (all versions before 13.0.0) allows remote unauthenticated attackers to supply a crafted TAR archive that traps the parser in an uncontrolled loop, consuming a full CPU core and never returning. The exposure is sharply limited because only applications that directly call PIL.TarIO.TarIO on attacker-controlled archives are affected; the default Image.open() path does not reach this parser. No public exploit code was identified at time of analysis, and the raw 7.1 CVSS 4.0 score should be weighed against the non-default API prerequisite and required user or service interaction to supply the malicious archive.
Denial of service in Pillow's PDF append workflow (versions 5.1.0 through 12.x) lets an unauthenticated remote attacker exhaust CPU by supplying a compact malformed PDF whose /Pages /Kids arrays repeatedly reference the same child /Pages node. When an application calls Image.save(..., format="PDF", append=True) on that attacker-controlled file, PdfParser.linearize_page_tree() expands the shared subtree as if it were distinct pages, producing exponentially many page references before the append completes. Impact is availability-only (C:N/I:N/A:H) and reachability is narrow - ordinary image decoding and standalone PDF export never hit this code path - so no public exploit code has been identified at time of analysis and the issue is fixed in Pillow 13.0.0.
Heap buffer over-read in Pillow's Windows-only WMF/EMF renderer (versions prior to 13.0.0) lets a crafted wide, short metafile trigger out-of-bounds memory reads during rasterization. Pillow passes unchecked 32-bit metafile dimensions into the native drawwmf handler, which allocates a DIB using 16-bit-truncated width/height fields but then copies pixel data using the original full dimensions; because the truncated geometry keeps the total pixel count small, the image passes Pillow's decompression-bomb check while the copy still walks past the end of the heap buffer. Only Windows deployments that render attacker-supplied metafiles are exposed, and rendering must be explicitly initiated (UI:R); the practical outcome is limited disclosure of adjacent heap memory or a process crash via the enlarged read, with no public exploit identified at time of analysis and no CISA KEV listing.
Heap-based out-of-bounds write in Pillow's JPEG encoder (9.4.0 through 12.x) can crash a process and may enable code execution when an application re-saves an attacker-supplied image while preserving both an ICC profile and a forwarded COM comment. The flaw is triggered only when the ICC profile exactly fills the 65536-byte encoder buffer, causing libjpeg's free_in_buffer accounting to wrap before the comment is written; exploitation is application-behavior-dependent and heap-layout-sensitive. Vendor-released patch: 13.0.0; no public exploit identified at time of analysis.
Argument injection in Pillow's EPS decoding path (EpsImagePlugin.Ghostscript) lets a caller-controlled input filename be parsed as a Ghostscript option, and in the worst case escalates to arbitrary command execution. All Pillow releases from 2.6.0 up to but not including 13.0.0 are affected when Ghostscript is installed and the host application passes an unsanitized, attacker-influenced filename into Image.open() for EPS input; no authentication is required per the CVSS vector (PR:N), though exploitation depends on that application-level precondition. Making the path absolute before it is placed after Ghostscript's -f flag closes the issue, and the vendor shipped that change in 13.0.0 (commit a2c3631); no public exploit code or confirmed active exploitation was identified at time of analysis.
Uninitialized heap memory disclosure in Pillow 5.3.0 through 12.x allows remote attackers to read stale process memory by supplying a crafted TIFF that uses JPEG (COMPRESSION=7) or Group 4 fax compression and triggers a libtiff 'short decode', after which the library converts rows from a buffer whose unwritten tail was never cleared. The tile decode path has been affected since 5.3.0 and the strip path since 6.0.0, and the impact is confidentiality-only (memory disclosure with no corruption, crash, or code execution) - an application is only exposed if it both decodes the attacker-supplied image and returns or re-encodes the resulting pixel data, since that output channel is the only way the stale bytes reach the attacker. No public exploit code or active exploitation is indicated in the available data, and the issue is fixed in Pillow 13.0.0.
Out-of-bounds read in Pillow's TIFF encoder before 13.0.0 allows unauthenticated remote attackers to leak heap memory or cause a denial of service (process crash) when an application saves or re-encodes a malicious TIFF using the libtiff encoder. Exploitation requires the target to re-encode the attacker-supplied image-simply opening it does not trigger the bug-and the leak is limited to adjacent heap bytes rather than targeted data. No public exploit has been identified at time of analysis, and the vendor has released Pillow 13.0.0 to fix the issue.
Denial of service in Pillow (Python imaging library) versions 5.1.0 through 12.x allows remote attackers to crash or hang applications that append images to attacker-influenced PDFs. PdfParser lacks cycle and duplication tracking when following page-tree /Kids references and only guards against exact repeated trailer offsets, so a crafted PDF with a deep or cyclic page tree, repeated non-cyclic /Kids entries, or a long chain of unique previous-trailer offsets can raise an uncaught RecursionError or drive super-linear CPU and memory consumption before any output is written. Exploitation requires the target application to call Image.save with PDF append enabled against a PDF the attacker can supply; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though the availability-only impact and trivial prerequisites justify prompt patching to 13.0.0.
Denial of service in Pillow 5.1.0 through 12.x: when an application uses Image.save with save_all=True to convert a multi-frame image (APNG, GIF, TIFF) into a multipage PDF, PdfParser.next_object_id() rebuilds and rescans the entire set of previously reserved PDF object identifiers for every object, producing quadratic runtime in the number of frames. Because the cost scales with the declared frame count, an unauthenticated remote attacker can submit a very small APNG that advertises a huge number of frames and exhaust CPU on the converting service. Active exploitation has not been confirmed (no CISA KEV listing) and no public exploit code was identified at time of analysis, but the trigger is trivial for anyone who can reach an image-to-PDF conversion workflow; the vendor fixed it in Pillow 13.0.0 via GHSA-jg86-v3jv-hrpm.
Pillow versions 10.0.0 through 12.x can free an invalid glyph pointer during FreeType text rendering when an active stroker is used, allowing malformed font bytes supplied by an attacker to corrupt memory or crash the process. Exploitation requires the application to render text with a nonzero stroke width and load an attacker-controlled font from untrusted bytes; no authentication or user interaction is required on the application side, but the attack requirements are present because the stroking path must be enabled. There is no CISA KEV confirmation and no public exploit identified at time of analysis; the issue is fixed in Pillow 13.0.0.
Memory exhaustion denial of service in Pillow 4.1.0 through 12.x allows unauthenticated remote attackers to exhaust server memory when an application decodes a crafted MSP image and loads its pixels. The MSP RLE decoder writes expanded run-length output into an in-memory buffer without limiting it to the declared image dimensions, bypassing Pillow's decompression-bomb pixel-count guard; no public exploit identified at time of analysis.
Denial of service in Pillow 5.1.0 through versions before 13.0.0 allows unauthenticated remote attackers to exhaust a processing worker's CPU by supplying a crafted PDF whose page tree contains a Parent-reference cycle when an application uses Pillow to append an image to that PDF. The flaw is an uncontrolled infinite loop in PdfParser.rewrite_pages(), giving availability-only impact with no confidentiality or integrity effect. Vendor-released patch: 13.0.0; no public exploit identified at time of analysis.
Denial of service in Pillow 12.0.0 through 12.x lets unauthenticated remote attackers crash a Python process by supplying a crafted IPTC image that reaches Image.merge(), or by calling Image.merge() with an I/F first band backed by image32 storage. The flaw is a null-pointer dereference (CWE-476) with high availability impact but no confidentiality or integrity impact; it is fixed in 13.0.0 and no public exploit was identified at time of analysis.
Heap out-of-bounds over-read in Pillow 8.1.0 through 12.x allows a crafted TIFF processed by an application using libtiff-backed decoding to copy adjacent heap contents into output pixels or crash the process. The flaw affects the tile path in _decodeTile and the RGBA unpacker when duplicated PhotometricInterpretation or BitsPerSample tags are interpreted differently by Pillow and libtiff; the strip path is not affected. No public exploit code or CISA KEV entry was identified at time of analysis, and upgrading to 13.0.0 fixes the issue.
Heap buffer overflow in Pillow's JPEG decoder (all versions prior to 13.0.0) lets a crafted 8-bit lossless SOF3 JPEG corrupt heap memory, crash the process, and potentially achieve code execution when an application requests downscaling through draft() or thumbnail(). Exploitation is unauthenticated but conditional: the Pillow build must be linked against libjpeg-turbo 3.x, because libjpeg-turbo 2.x and IJG builds reject the SOF3 input outright, and the application must actually call draft()/thumbnail() on attacker-supplied images - a common pattern in upload/thumbnail pipelines, which is the realistic exposure surface. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the CVSS 4.0 score of 9.2 reflects high confidentiality/integrity/availability impact, tempered by the AC:H rating derived from the narrow build-configuration prerequisite.
Memory corruption in Pillow versions prior to 13.0.0 can crash the process when Image.transform() takes the fast Transform.EXTENT or pure scale-and-translate Transform.AFFINE path with default NEAREST resampling and a selective allocation failure occurs under memory pressure. The defect is a double free/use-after-free in ImagingScaleAffine: the output image allocation succeeds, the additional per-column lookup allocation fails, and the error path deletes image storage that later cleanup releases again (CWE-416). The assessed impact is availability-only with no confidentiality or integrity effect, exploitation depends on attacker-influenced transform sizes plus genuine memory pressure, and no public exploit identified at time of analysis.
Process crash in Pillow before 13.0.0 can be triggered when an application decodes an attacker-supplied PPM or PGM image with zero width and then applies an ImageMorph morphology operation. The flaw is an out-of-bounds memory access in the native morphology routine, and unauthenticated remote attackers can exploit it only when that specific ImageMorph code path is used, resulting in denial of service rather than data exposure or code execution. Vendor-released patch: 13.0.0; no public exploit identified at time of analysis.
Denial of service in Pillow prior to 13.0.0 occurs when ImageFilter.RankFilter, MedianFilter, MinFilter, or MaxFilter is applied to a zero-width or zero-height image, triggering a native null pointer dereference during edge expansion and crashing the process. Remote, unauthenticated attackers who can supply or cause creation of such a zero-dimension image to an application that uses these rank filters can cause high availability impact only (C:N/I:N/A:H per the assessed CVSS 3.1 vector; official CVSS 4.0 score 8.2 with AT:P). No public exploit code or confirmed active exploitation is identified at time of analysis, and no EPSS data was provided.
Memory exhaustion denial of service in Pillow 9.2.0 through pre-13.0.0 can be triggered by a crafted multi-frame GIF that leaves rejected, oversized frame dimensions stored after Image.DecompressionBombError is raised. The flaw is exploitable only in applications that catch that exception and then continue calling seek() or load() on the same GifImageFile object; applications that let the exception propagate or discard the image object are not affected. It is an availability-only issue, with no public exploit identified at time of analysis and no CISA KEV confirmation.
Memory exhaustion in Pillow 8.1.0 through 12.x allows unauthenticated remote attackers to cause denial of service by supplying a crafted APNG that triggers a full-canvas background allocation inside Image.open() before the decompression-bomb check. The flaw is reachable when an application parses untrusted images with an affected version; no pixel loading, frame iteration, authentication, or user interaction is required. No public exploit code or CISA KEV entry was identified at time of analysis, but the availability impact is high (CVSS 8.7; assessed CVSS:3.1 A:H).
Heap-based buffer overflow in Pillow before 13.0.0 can corrupt memory and potentially enable arbitrary code execution when an application with the optional olefile dependency opens or thumbnails a crafted OLE2 FlashPix (FPX) image. The flaw is reachable by unauthenticated remote attackers who can supply malicious image input, but exposure is limited to deployments that have installed olefile and process untrusted FPX content; no public exploit identified at time of analysis, and no confirmed active exploitation (CISA KEV). The vendor-released patch is Pillow 13.0.0.
Heap use-after-free in Pillow 11.3.0 through 12.x can crash any Python process that encodes TIFF data into an in-memory buffer while an attacker influences the TIFF tags being written. When an application saves to BytesIO with a tiffinfo dictionary containing a tag libtiff rejects during encoding - the documented trigger is a floating-point predictor (PREDICTOR=3) applied to integer sample data - TIFFWriteScanline fails inside ImagingLibTiffEncode, the error path frees the output buffer without closing the TIFF handle, and a later cleanup flushes buffered bytes through the write callback into freed memory. The vector (CVSS 5.9, AV:N/AC:H/PR:N/UI:N, C:N/I:N/A:H) reflects unauthenticated but configuration-dependent reachability: exploitation needs the memory-buffer code path plus attacker-controlled tag values, and the reliable outcome is process termination, with code execution unproven; no public exploit identified at time of analysis, and the upstream fix commit ships a regression test rather than weaponized tooling.
Heap out-of-bounds read in Pillow's tiled-TIFF decoder (versions 8.2.0 through 12.x) lets a crafted TIFF file cause the stride-and-copy loop in _decodeTile to walk past the buffer libtiff allocated, potentially exposing adjacent heap contents in the returned pixel data or crashing the process. Any application that opens untrusted TIFF images with an affected Pillow build is exposed without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, 6.5), though impact is bounded to partial confidentiality loss and partial availability loss with no write primitive. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fix in 13.0.0 makes the decoder reject the triggering images with 'decoder error -2'.
Heap buffer overflow and stale-heap disclosure in Pillow's compressed TIFF save path can crash the process and potentially enable code execution when an application writes TIFF data to an in-memory stream such as io.BytesIO. Affected are Pillow versions 2.0.0 through 12.x (fixed in 13.0.0) that use libtiff and process attacker-influenced out-of-line TIFF tags or retained ICC profiles; file paths and targets with real file descriptors are not affected. The flaw requires a specific combination of compressed saving, seek-past-end behavior, and controlled tag data (AC:H/AT:P), and no public exploit code has been identified at time of analysis.
Pillow versions 7.2.0 through 12.x can hang indefinitely at full CPU when an application reads n_frames or saves all frames from a crafted MIC image; MicImageFile inherits TIFF frame traversal but its tell() reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances the traversal. The attacker only needs to supply the MIC file, but exploitation requires the optional olefile package to be installed and the application to invoke the frame-count or save-all code path - default Pillow installs that never touch MIC frames are unaffected. Impact is confined to availability (CWE-835 uncontrolled loop, no confidentiality or integrity effect); vendor-released patch: 13.0.0.
Out-of-bounds memory disclosure in Python Pillow before 12.3.0 lets an attacker who supplies a crafted McIdas AREA image file read adjacent process memory or crash the host application. When such a file is opened from a filename, header words control the raw-codec mmap row stride; setting it below the true row width causes later pixel operations (tobytes, getpixel, convert, save) to read past the mapped region. No public exploit is identified at time of analysis and it is not in CISA KEV, but the upstream fix, PR, and a regression test are public, making the flaw well documented.
Heap out-of-bounds write in Python Pillow prior to 12.3.0 lets an attacker who controls the rank-filter size parameter corrupt native heap memory and crash or potentially manipulate the process. ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before validating the filter size, and the native ImagingExpand() routine computes output dimensions using unchecked signed-int arithmetic, so a very large odd size overflows and drives an out-of-bounds write (CWE-787). No public exploit is identified at time of analysis; the flaw is fixed in Pillow 12.3.0.
Uncontrolled memory consumption in Python Pillow (PIL) versions 5.1.0 through 12.2.x allows a remote attacker to cause denial of service by supplying a small crafted PDF whose FlateDecode stream declares a large Length; PdfParser.PdfStream.decode() passes this attacker-controlled Length straight to zlib.decompress() as the bufsize with no upper bound, so a tiny file inflates into gigabytes of decompressed data and exhausts host memory. Fixed in 12.3.0 by streaming decompression with a bounded max_length. No public exploit identified at time of analysis and this CVE is not in CISA KEV, but the trigger is trivial to construct.
Out-of-bounds heap read in Python Pillow's TGA RLE encoder (versions 5.2.0 through 12.2.x) lets adjacent process heap bytes leak into a generated TGA file when an application saves a mode '1' (1-bit) image using compression='tga_rle'. The flaw is an information-disclosure bug (CWE-125), fixed in 12.3.0, with no public exploit identified at time of analysis. The NVD CVSS of 7.5 (network vector) overstates practical reach because triggering the leak depends on the host application invoking this specific and unusual save path.
Denial-of-service and controlled heap corruption in Python's Pillow imaging library (all versions prior to 12.3.0) occurs when ImageCms.ImageCmsTransform.apply() is invoked with an output image whose mode does not match the transform's declared output mode, causing an out-of-bounds write in the native color-management code. The pre-fix code only validated the output mode and never validated the input mode, so a mismatched buffer geometry lets the C-level transform write past allocation bounds. No public exploit has been identified at time of analysis; the fix is confirmed in release 12.3.0 via the vendor security advisory GHSA-9hw9-ch79-4vh6.
Denial of service in Python Pillow 12.0.0 through 12.2.0 lets a remote attacker hang an application by supplying a crafted EPS image whose %%BeginBinary directive declares a negative byte count, causing the EPS parser to seek backwards and re-parse the same directive forever. Any service that calls Image.open() on attacker-supplied EPS data is affected until upgraded to 12.3.0. No public exploit identified at time of analysis, though the upstream fix PR includes a test reproducer; the flaw is not listed in CISA KEV.
Denial of service (and potential memory corruption) in Python Pillow before 12.3.0 arises when public image coordinate APIs - Image.paste(), Image.crop(), and Image.alpha_composite() - are handed box coordinates near the signed 32-bit integer boundary (±2**31), causing a native heap out-of-bounds write in the C imaging core. Any application that forwards untrusted coordinate values into these calls can be crashed, and the OOB write raises the theoretical prospect of heap corruption. No public exploit identified at time of analysis; the fix (integer-overflow-safe int64_t arithmetic) shipped in 12.3.0.
Denial of service in Python Pillow (versions 8.2.0 through 12.2.0) allows remote attackers to exhaust memory during JPEG2000 decoding, causing out-of-memory failures in any application that decodes untrusted images. The flaw stems from Pillow's JPEG2000 decoder summing tile widths across the whole image rather than per tile, so a small crafted tiled file forces disproportionately large transient allocations. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the upstream fix (12.3.0) and a public PR/commit make the root cause fully transparent.
Uncontrolled memory allocation in Python Pillow before 12.3.0 lets a crafted BDF font file exhaust available memory and crash the host application. The BdfFontFile parser trusts the attacker-supplied BBX width/height fields and hands them to Image.new() while skipping Pillow's decompression-bomb size check, so a tiny malicious font can request a huge in-memory bitmap. Impact is availability-only (denial of service); there is no public exploit identified at time of analysis and the issue is not in CISA KEV.
Denial-of-service via memory exhaustion in Python Pillow before 12.3.0 allows a crafted GD-format (.gd) image to trigger excessive C-heap allocation when opened, because GdImageFile._open() reads image dimensions straight from the GD 2.x header without invoking Pillow's Image._decompression_bomb_check() guard. Any application that loads untrusted .gd files with a vulnerable Pillow version can be crashed or driven into out-of-memory conditions. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 (availability-only impact).
Uncontrolled memory allocation in Python Pillow before 12.3.0 allows a maliciously crafted font file to trigger excessive memory consumption and denial of service when its glyphs are compiled into a combined bitmap. FontFile.compile() builds the output image via Image.new("1", (xsize, ysize)) without invoking Pillow's decompression-bomb guard, so oversized glyph dimensions are allocated unchecked during conversion or saving. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the availability-only impact (CVSS 7.5) reflects resource exhaustion rather than code execution or data disclosure.
Uncontrolled memory allocation in the Python Pillow imaging library (all versions prior to 12.3.0) allows a crafted PCF bitmap font to exhaust process memory and crash the host application. The PcfFontFile bitmap loader trusts attacker-supplied glyph dimensions from the font's METRICS section and hands them straight to Image.frombytes() while skipping Pillow's decompression-bomb guard. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the flaw is an availability-only denial of service (CVSS 7.5), not the information disclosure implied by the source tag.
Out-of-bounds write in Pillow versions 10.3.0 through 12.1.0 allows remote denial of service when processing maliciously crafted PSD image files. An attacker can trigger a crash by supplying a specially crafted image without authentication or user interaction. A patch is available in version 12.1.1.
Pillow 11.2.1 through 12.x can disclose uninitialized padding, bytes preceding the first row, or stale heap contents when an application sets a non-default PILLOW_ALIGNMENT and exports images through the Arrow C interface (__arrow_c_array__/__arrow_c_schema__). The flaw is limited to deployments that both customize alignment and use Arrow export, with meaningful cross-user exposure requiring a multi-user context where one user's exported buffer can reach another user; default Pillow configurations are not affected. No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor released Pillow 13.0.0 as the fix.
Integer underflow in Pillow's legacy PILfont text-width calculation (CVE-2026-96641, GHSA-4rm8-3hmm-39fg) can be triggered when an application loads and measures text with a manipulated .pil bitmap font, producing a low-impact availability condition; the Pillow project rates it Medium and fixed it in release 13.0.0. The assessed CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating a local attack vector, no privileges required, no user interaction, and impact limited to availability with no confidentiality or integrity effect. No public exploit was identified at time of analysis, and no CISA KEV entry is indicated in the available data.
Memory-amplification denial of service in Pillow's BMP RLE decoder (BI_RLE4/BI_RLE8) allows unauthenticated remote attackers to exhaust memory by delivering a small crafted BMP to any image pipeline that processes untrusted files with Pillow before 13.0.0. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is limited to availability with no code execution or information disclosure; the Pillow project classifies this issue as Medium severity. No public exploit code was identified at time of analysis, and exploitation requires the application to actually route attacker-supplied BMP data into Pillow's decoder.
Denial-of-service in Pillow's multi-frame image handling: the MAX_IMAGE_PIXELS decompression-bomb guard can be bypassed for MPO, DCX, and MIC containers when an application calls seek() to navigate to frames or pages beyond the first, allowing a small attacker-supplied file to trigger unbounded memory and CPU consumption. Only applications that open these specific multi-frame formats and seek past the first frame are affected; single-frame opens and first-frame-only pipelines are not. The flaw is rated CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (availability-only, no confidentiality or integrity impact), affects Pillow releases prior to 13.0.0, and no public exploit code was identified at time of analysis.
Regular-expression denial of service in Pillow before 13.0.0 lets unauthenticated remote attackers stall an image-processing worker by submitting a tiny crafted XBM file that triggers catastrophic backtracking in the XBM header parser before image dimensions are ever validated. Any service that routes untrusted uploads through Image.open() with XBM parsing reachable is affected; impact is confined to availability degradation of the decoding worker, with no code execution, data exposure, or integrity impact. The flaw is fixed in Pillow 13.0.0, which replaces the backtracking regex with line-based parsing; no public exploit tooling or confirmed active exploitation was identified at time of analysis, though the upstream fix commit includes a regression test that reproduces a minimal triggering input.
Uninitialized stack memory disclosure in Pillow 9.1.0 through 12.x allows an attacker who controls a palette image passed to Image.quantize(palette=p) to receive raw stack contents - including pointer addresses and stack-canary bytes - embedded as pixel indices in the returned PNG or GIF. Exploitation is not implicit in normal Pillow use: the application must expose the quantize-with-palette path to untrusted input and must accept an attacker-supplied palette whose palette data is empty (p.palette.palette == b""), which causes ImagingPaletteCacheUpdate() to leave its local cache array uninitialized before those bytes are emitted by the topalette() conversion path. The flaw yields confidentiality-only impact with no memory corruption or crash; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the vendor-released fix is Pillow 13.0.0.
Saving attacker-controlled images as GIF in Python Pillow 9.2.0 through 12.x can drive quadratic comment-header assembly and consume excessive CPU, delaying or denying service. The issue is reachable without authentication or user interaction (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N), but only when an application preserves a very large embedded GIF comment and re-encodes the image as GIF; impact is limited to availability. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and the vendor-released fix is Pillow 13.0.0.
Denial of service in Pillow 5.4.0 through pre-13.0.0 allows unauthenticated remote attackers to exhaust CPU by supplying a crafted GIF containing numerous comment extensions; Image.open() parses frame zero and triggers quadratic bytes copying in GifImageFile._seek() before the application can inspect the image. Impact is limited to availability (vendor CVSS 4.0 score 6.9; assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), with no code execution or data exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and environments that only open trusted images are not practically exposed.
Out-of-bounds heap read in Pillow prior to 13.0.0 lets unauthenticated remote attackers disclose up to three adjacent heap bytes or crash the process, but only when the application explicitly decodes attacker-controlled data using the uncommon planar palette raw modes P;2L or P;4L. This is a genuine but moderate-severity CWE-126 memory-safety defect rather than a top-tier priority: these raw modes are not reached by ordinary image-file opening or auto-detection, and impact is bounded to limited information disclosure or denial of service with no code execution or integrity loss. No public exploit identified at time of analysis; the provided intelligence contains no KEV listing and no POC reference.
Unbounded recursion in Pillow's PDF parser (versions 5.1.0 through 12.x) can crash a Python worker when an application opens an attacker-supplied PDF for append, producing availability-only denial of service. The issue is reachable only when the application explicitly uses Pillow's PDF append mode on untrusted input; the independent assessment rates it as a modest-priority availability issue, not a top-tier emergency, and no public exploit has been identified at time of analysis. Pillow 13.0.0 fixes the problem by capping parser nesting depth.
Command injection in Pillow's WindowsViewer component (all versions prior to 12.3.0) allows arbitrary cmd.exe command execution when a user opens an image with a crafted filename containing shell metacharacters. The root cause is in WindowsViewer.get_command(), which embeds an unsanitized file path directly into an f-string and passes the result to subprocess.Popen with shell=True on Windows. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0.
An issue was discovered in Pillow before 10.0.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Pillow before 8.2.0. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
An issue was discovered in Pillow before 8.2.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in Pillow before 8.2.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in Pillow before 8.2.0. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Pillow before 8.2.0. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Pillow before 8.2.0. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Pillow before 8.1.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Pillow before 8.1.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Pillow before 8.1.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Pillow before 8.1.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Pillow before 8.1.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in Pillow before 6.2.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer Overflow" issue affecting the. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Pillow versions 11.0.0 through 12.x (fixed in 13.0.0) can reuse a stale native ImagingCore buffer when a multi-frame image is advanced to a later frame whose pixel mode widens from a narrow format to RGB or CMYK, or whose dimensions change, producing native out-of-bounds writes and crashes; the MPO path can additionally over-read memory and, on specific runtime/heap profiles, achieve command execution. Exploitation requires the application to open an attacker-supplied PSD, MPO, DCX, or MIC file and actually seek/load past the first frame, since reading only the initial frame does not trigger the bug; no credentials or user interaction are needed in an automated image-processing pipeline. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, although the 9.8 CVSS and the trivially craftable file format make weaponization plausible for any service that validates or thumbnails multi-frame uploads.
Memory exhaustion in Pillow's SPIDER image plugin lets an attacker-supplied multi-frame .spider stack file bypass the library's decompression-bomb guard and drive allocations of several gigabytes. The flaw lives in SpiderImageFile.seek(), which reparses a later frame and overwrites self._size without re-running Image._decompression_bomb_check(), so a tiny file with a benign first frame passes Image.open() and then declares enormous dimensions in a later mode-F frame; loading that frame consumes roughly four bytes per attacker-declared pixel. All Pillow releases prior to 13.0.0 that parse SPIDER stacks are affected, and exploitation requires the application to open an untrusted multi-frame SPIDER file and then seek past frame 0 - a niche, passive-interaction path consistent with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor patch is 13.0.0.
Denial of service in Pillow 11.0.0 through 12.x lets an attacker-supplied PNG file consume unbounded CPU time when the application parses its EXIF metadata. Because PngImagePlugin accepts an uncapped eXIf chunk, a file stuffed with repeated six-byte 'Exif\x00\x00' headers causes Exif.load() to make a new shrinking copy of the buffer on every loop iteration, producing quadratic work that is triggered through routine calls such as Image.getexif(), Image._getexif(), or ImageOps.exif_transpose() - the latter backing many photo-upload auto-rotation workflows. The CVSS 4.0 score is 7.1 (assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), reflecting a pure availability impact with no confidentiality or integrity loss; no public exploit code or CISA KEV entry was identified at time of analysis, and a vendor fix ships in 13.0.0.
Denial of service in Pillow's legacy TarIO parser (all versions before 13.0.0) allows remote unauthenticated attackers to supply a crafted TAR archive that traps the parser in an uncontrolled loop, consuming a full CPU core and never returning. The exposure is sharply limited because only applications that directly call PIL.TarIO.TarIO on attacker-controlled archives are affected; the default Image.open() path does not reach this parser. No public exploit code was identified at time of analysis, and the raw 7.1 CVSS 4.0 score should be weighed against the non-default API prerequisite and required user or service interaction to supply the malicious archive.
Denial of service in Pillow's PDF append workflow (versions 5.1.0 through 12.x) lets an unauthenticated remote attacker exhaust CPU by supplying a compact malformed PDF whose /Pages /Kids arrays repeatedly reference the same child /Pages node. When an application calls Image.save(..., format="PDF", append=True) on that attacker-controlled file, PdfParser.linearize_page_tree() expands the shared subtree as if it were distinct pages, producing exponentially many page references before the append completes. Impact is availability-only (C:N/I:N/A:H) and reachability is narrow - ordinary image decoding and standalone PDF export never hit this code path - so no public exploit code has been identified at time of analysis and the issue is fixed in Pillow 13.0.0.
Heap buffer over-read in Pillow's Windows-only WMF/EMF renderer (versions prior to 13.0.0) lets a crafted wide, short metafile trigger out-of-bounds memory reads during rasterization. Pillow passes unchecked 32-bit metafile dimensions into the native drawwmf handler, which allocates a DIB using 16-bit-truncated width/height fields but then copies pixel data using the original full dimensions; because the truncated geometry keeps the total pixel count small, the image passes Pillow's decompression-bomb check while the copy still walks past the end of the heap buffer. Only Windows deployments that render attacker-supplied metafiles are exposed, and rendering must be explicitly initiated (UI:R); the practical outcome is limited disclosure of adjacent heap memory or a process crash via the enlarged read, with no public exploit identified at time of analysis and no CISA KEV listing.
Heap-based out-of-bounds write in Pillow's JPEG encoder (9.4.0 through 12.x) can crash a process and may enable code execution when an application re-saves an attacker-supplied image while preserving both an ICC profile and a forwarded COM comment. The flaw is triggered only when the ICC profile exactly fills the 65536-byte encoder buffer, causing libjpeg's free_in_buffer accounting to wrap before the comment is written; exploitation is application-behavior-dependent and heap-layout-sensitive. Vendor-released patch: 13.0.0; no public exploit identified at time of analysis.
Argument injection in Pillow's EPS decoding path (EpsImagePlugin.Ghostscript) lets a caller-controlled input filename be parsed as a Ghostscript option, and in the worst case escalates to arbitrary command execution. All Pillow releases from 2.6.0 up to but not including 13.0.0 are affected when Ghostscript is installed and the host application passes an unsanitized, attacker-influenced filename into Image.open() for EPS input; no authentication is required per the CVSS vector (PR:N), though exploitation depends on that application-level precondition. Making the path absolute before it is placed after Ghostscript's -f flag closes the issue, and the vendor shipped that change in 13.0.0 (commit a2c3631); no public exploit code or confirmed active exploitation was identified at time of analysis.
Uninitialized heap memory disclosure in Pillow 5.3.0 through 12.x allows remote attackers to read stale process memory by supplying a crafted TIFF that uses JPEG (COMPRESSION=7) or Group 4 fax compression and triggers a libtiff 'short decode', after which the library converts rows from a buffer whose unwritten tail was never cleared. The tile decode path has been affected since 5.3.0 and the strip path since 6.0.0, and the impact is confidentiality-only (memory disclosure with no corruption, crash, or code execution) - an application is only exposed if it both decodes the attacker-supplied image and returns or re-encodes the resulting pixel data, since that output channel is the only way the stale bytes reach the attacker. No public exploit code or active exploitation is indicated in the available data, and the issue is fixed in Pillow 13.0.0.
Out-of-bounds read in Pillow's TIFF encoder before 13.0.0 allows unauthenticated remote attackers to leak heap memory or cause a denial of service (process crash) when an application saves or re-encodes a malicious TIFF using the libtiff encoder. Exploitation requires the target to re-encode the attacker-supplied image-simply opening it does not trigger the bug-and the leak is limited to adjacent heap bytes rather than targeted data. No public exploit has been identified at time of analysis, and the vendor has released Pillow 13.0.0 to fix the issue.
Denial of service in Pillow (Python imaging library) versions 5.1.0 through 12.x allows remote attackers to crash or hang applications that append images to attacker-influenced PDFs. PdfParser lacks cycle and duplication tracking when following page-tree /Kids references and only guards against exact repeated trailer offsets, so a crafted PDF with a deep or cyclic page tree, repeated non-cyclic /Kids entries, or a long chain of unique previous-trailer offsets can raise an uncaught RecursionError or drive super-linear CPU and memory consumption before any output is written. Exploitation requires the target application to call Image.save with PDF append enabled against a PDF the attacker can supply; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though the availability-only impact and trivial prerequisites justify prompt patching to 13.0.0.
Denial of service in Pillow 5.1.0 through 12.x: when an application uses Image.save with save_all=True to convert a multi-frame image (APNG, GIF, TIFF) into a multipage PDF, PdfParser.next_object_id() rebuilds and rescans the entire set of previously reserved PDF object identifiers for every object, producing quadratic runtime in the number of frames. Because the cost scales with the declared frame count, an unauthenticated remote attacker can submit a very small APNG that advertises a huge number of frames and exhaust CPU on the converting service. Active exploitation has not been confirmed (no CISA KEV listing) and no public exploit code was identified at time of analysis, but the trigger is trivial for anyone who can reach an image-to-PDF conversion workflow; the vendor fixed it in Pillow 13.0.0 via GHSA-jg86-v3jv-hrpm.
Pillow versions 10.0.0 through 12.x can free an invalid glyph pointer during FreeType text rendering when an active stroker is used, allowing malformed font bytes supplied by an attacker to corrupt memory or crash the process. Exploitation requires the application to render text with a nonzero stroke width and load an attacker-controlled font from untrusted bytes; no authentication or user interaction is required on the application side, but the attack requirements are present because the stroking path must be enabled. There is no CISA KEV confirmation and no public exploit identified at time of analysis; the issue is fixed in Pillow 13.0.0.
Memory exhaustion denial of service in Pillow 4.1.0 through 12.x allows unauthenticated remote attackers to exhaust server memory when an application decodes a crafted MSP image and loads its pixels. The MSP RLE decoder writes expanded run-length output into an in-memory buffer without limiting it to the declared image dimensions, bypassing Pillow's decompression-bomb pixel-count guard; no public exploit identified at time of analysis.
Denial of service in Pillow 5.1.0 through versions before 13.0.0 allows unauthenticated remote attackers to exhaust a processing worker's CPU by supplying a crafted PDF whose page tree contains a Parent-reference cycle when an application uses Pillow to append an image to that PDF. The flaw is an uncontrolled infinite loop in PdfParser.rewrite_pages(), giving availability-only impact with no confidentiality or integrity effect. Vendor-released patch: 13.0.0; no public exploit identified at time of analysis.
Denial of service in Pillow 12.0.0 through 12.x lets unauthenticated remote attackers crash a Python process by supplying a crafted IPTC image that reaches Image.merge(), or by calling Image.merge() with an I/F first band backed by image32 storage. The flaw is a null-pointer dereference (CWE-476) with high availability impact but no confidentiality or integrity impact; it is fixed in 13.0.0 and no public exploit was identified at time of analysis.
Heap out-of-bounds over-read in Pillow 8.1.0 through 12.x allows a crafted TIFF processed by an application using libtiff-backed decoding to copy adjacent heap contents into output pixels or crash the process. The flaw affects the tile path in _decodeTile and the RGBA unpacker when duplicated PhotometricInterpretation or BitsPerSample tags are interpreted differently by Pillow and libtiff; the strip path is not affected. No public exploit code or CISA KEV entry was identified at time of analysis, and upgrading to 13.0.0 fixes the issue.
Heap buffer overflow in Pillow's JPEG decoder (all versions prior to 13.0.0) lets a crafted 8-bit lossless SOF3 JPEG corrupt heap memory, crash the process, and potentially achieve code execution when an application requests downscaling through draft() or thumbnail(). Exploitation is unauthenticated but conditional: the Pillow build must be linked against libjpeg-turbo 3.x, because libjpeg-turbo 2.x and IJG builds reject the SOF3 input outright, and the application must actually call draft()/thumbnail() on attacker-supplied images - a common pattern in upload/thumbnail pipelines, which is the realistic exposure surface. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the CVSS 4.0 score of 9.2 reflects high confidentiality/integrity/availability impact, tempered by the AC:H rating derived from the narrow build-configuration prerequisite.
Memory corruption in Pillow versions prior to 13.0.0 can crash the process when Image.transform() takes the fast Transform.EXTENT or pure scale-and-translate Transform.AFFINE path with default NEAREST resampling and a selective allocation failure occurs under memory pressure. The defect is a double free/use-after-free in ImagingScaleAffine: the output image allocation succeeds, the additional per-column lookup allocation fails, and the error path deletes image storage that later cleanup releases again (CWE-416). The assessed impact is availability-only with no confidentiality or integrity effect, exploitation depends on attacker-influenced transform sizes plus genuine memory pressure, and no public exploit identified at time of analysis.
Process crash in Pillow before 13.0.0 can be triggered when an application decodes an attacker-supplied PPM or PGM image with zero width and then applies an ImageMorph morphology operation. The flaw is an out-of-bounds memory access in the native morphology routine, and unauthenticated remote attackers can exploit it only when that specific ImageMorph code path is used, resulting in denial of service rather than data exposure or code execution. Vendor-released patch: 13.0.0; no public exploit identified at time of analysis.
Denial of service in Pillow prior to 13.0.0 occurs when ImageFilter.RankFilter, MedianFilter, MinFilter, or MaxFilter is applied to a zero-width or zero-height image, triggering a native null pointer dereference during edge expansion and crashing the process. Remote, unauthenticated attackers who can supply or cause creation of such a zero-dimension image to an application that uses these rank filters can cause high availability impact only (C:N/I:N/A:H per the assessed CVSS 3.1 vector; official CVSS 4.0 score 8.2 with AT:P). No public exploit code or confirmed active exploitation is identified at time of analysis, and no EPSS data was provided.
Memory exhaustion denial of service in Pillow 9.2.0 through pre-13.0.0 can be triggered by a crafted multi-frame GIF that leaves rejected, oversized frame dimensions stored after Image.DecompressionBombError is raised. The flaw is exploitable only in applications that catch that exception and then continue calling seek() or load() on the same GifImageFile object; applications that let the exception propagate or discard the image object are not affected. It is an availability-only issue, with no public exploit identified at time of analysis and no CISA KEV confirmation.
Memory exhaustion in Pillow 8.1.0 through 12.x allows unauthenticated remote attackers to cause denial of service by supplying a crafted APNG that triggers a full-canvas background allocation inside Image.open() before the decompression-bomb check. The flaw is reachable when an application parses untrusted images with an affected version; no pixel loading, frame iteration, authentication, or user interaction is required. No public exploit code or CISA KEV entry was identified at time of analysis, but the availability impact is high (CVSS 8.7; assessed CVSS:3.1 A:H).
Heap-based buffer overflow in Pillow before 13.0.0 can corrupt memory and potentially enable arbitrary code execution when an application with the optional olefile dependency opens or thumbnails a crafted OLE2 FlashPix (FPX) image. The flaw is reachable by unauthenticated remote attackers who can supply malicious image input, but exposure is limited to deployments that have installed olefile and process untrusted FPX content; no public exploit identified at time of analysis, and no confirmed active exploitation (CISA KEV). The vendor-released patch is Pillow 13.0.0.
Heap use-after-free in Pillow 11.3.0 through 12.x can crash any Python process that encodes TIFF data into an in-memory buffer while an attacker influences the TIFF tags being written. When an application saves to BytesIO with a tiffinfo dictionary containing a tag libtiff rejects during encoding - the documented trigger is a floating-point predictor (PREDICTOR=3) applied to integer sample data - TIFFWriteScanline fails inside ImagingLibTiffEncode, the error path frees the output buffer without closing the TIFF handle, and a later cleanup flushes buffered bytes through the write callback into freed memory. The vector (CVSS 5.9, AV:N/AC:H/PR:N/UI:N, C:N/I:N/A:H) reflects unauthenticated but configuration-dependent reachability: exploitation needs the memory-buffer code path plus attacker-controlled tag values, and the reliable outcome is process termination, with code execution unproven; no public exploit identified at time of analysis, and the upstream fix commit ships a regression test rather than weaponized tooling.
Heap out-of-bounds read in Pillow's tiled-TIFF decoder (versions 8.2.0 through 12.x) lets a crafted TIFF file cause the stride-and-copy loop in _decodeTile to walk past the buffer libtiff allocated, potentially exposing adjacent heap contents in the returned pixel data or crashing the process. Any application that opens untrusted TIFF images with an affected Pillow build is exposed without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, 6.5), though impact is bounded to partial confidentiality loss and partial availability loss with no write primitive. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fix in 13.0.0 makes the decoder reject the triggering images with 'decoder error -2'.
Heap buffer overflow and stale-heap disclosure in Pillow's compressed TIFF save path can crash the process and potentially enable code execution when an application writes TIFF data to an in-memory stream such as io.BytesIO. Affected are Pillow versions 2.0.0 through 12.x (fixed in 13.0.0) that use libtiff and process attacker-influenced out-of-line TIFF tags or retained ICC profiles; file paths and targets with real file descriptors are not affected. The flaw requires a specific combination of compressed saving, seek-past-end behavior, and controlled tag data (AC:H/AT:P), and no public exploit code has been identified at time of analysis.
Pillow versions 7.2.0 through 12.x can hang indefinitely at full CPU when an application reads n_frames or saves all frames from a crafted MIC image; MicImageFile inherits TIFF frame traversal but its tell() reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances the traversal. The attacker only needs to supply the MIC file, but exploitation requires the optional olefile package to be installed and the application to invoke the frame-count or save-all code path - default Pillow installs that never touch MIC frames are unaffected. Impact is confined to availability (CWE-835 uncontrolled loop, no confidentiality or integrity effect); vendor-released patch: 13.0.0.
Out-of-bounds memory disclosure in Python Pillow before 12.3.0 lets an attacker who supplies a crafted McIdas AREA image file read adjacent process memory or crash the host application. When such a file is opened from a filename, header words control the raw-codec mmap row stride; setting it below the true row width causes later pixel operations (tobytes, getpixel, convert, save) to read past the mapped region. No public exploit is identified at time of analysis and it is not in CISA KEV, but the upstream fix, PR, and a regression test are public, making the flaw well documented.
Heap out-of-bounds write in Python Pillow prior to 12.3.0 lets an attacker who controls the rank-filter size parameter corrupt native heap memory and crash or potentially manipulate the process. ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before validating the filter size, and the native ImagingExpand() routine computes output dimensions using unchecked signed-int arithmetic, so a very large odd size overflows and drives an out-of-bounds write (CWE-787). No public exploit is identified at time of analysis; the flaw is fixed in Pillow 12.3.0.
Uncontrolled memory consumption in Python Pillow (PIL) versions 5.1.0 through 12.2.x allows a remote attacker to cause denial of service by supplying a small crafted PDF whose FlateDecode stream declares a large Length; PdfParser.PdfStream.decode() passes this attacker-controlled Length straight to zlib.decompress() as the bufsize with no upper bound, so a tiny file inflates into gigabytes of decompressed data and exhausts host memory. Fixed in 12.3.0 by streaming decompression with a bounded max_length. No public exploit identified at time of analysis and this CVE is not in CISA KEV, but the trigger is trivial to construct.
Out-of-bounds heap read in Python Pillow's TGA RLE encoder (versions 5.2.0 through 12.2.x) lets adjacent process heap bytes leak into a generated TGA file when an application saves a mode '1' (1-bit) image using compression='tga_rle'. The flaw is an information-disclosure bug (CWE-125), fixed in 12.3.0, with no public exploit identified at time of analysis. The NVD CVSS of 7.5 (network vector) overstates practical reach because triggering the leak depends on the host application invoking this specific and unusual save path.
Denial-of-service and controlled heap corruption in Python's Pillow imaging library (all versions prior to 12.3.0) occurs when ImageCms.ImageCmsTransform.apply() is invoked with an output image whose mode does not match the transform's declared output mode, causing an out-of-bounds write in the native color-management code. The pre-fix code only validated the output mode and never validated the input mode, so a mismatched buffer geometry lets the C-level transform write past allocation bounds. No public exploit has been identified at time of analysis; the fix is confirmed in release 12.3.0 via the vendor security advisory GHSA-9hw9-ch79-4vh6.
Denial of service in Python Pillow 12.0.0 through 12.2.0 lets a remote attacker hang an application by supplying a crafted EPS image whose %%BeginBinary directive declares a negative byte count, causing the EPS parser to seek backwards and re-parse the same directive forever. Any service that calls Image.open() on attacker-supplied EPS data is affected until upgraded to 12.3.0. No public exploit identified at time of analysis, though the upstream fix PR includes a test reproducer; the flaw is not listed in CISA KEV.
Denial of service (and potential memory corruption) in Python Pillow before 12.3.0 arises when public image coordinate APIs - Image.paste(), Image.crop(), and Image.alpha_composite() - are handed box coordinates near the signed 32-bit integer boundary (±2**31), causing a native heap out-of-bounds write in the C imaging core. Any application that forwards untrusted coordinate values into these calls can be crashed, and the OOB write raises the theoretical prospect of heap corruption. No public exploit identified at time of analysis; the fix (integer-overflow-safe int64_t arithmetic) shipped in 12.3.0.
Denial of service in Python Pillow (versions 8.2.0 through 12.2.0) allows remote attackers to exhaust memory during JPEG2000 decoding, causing out-of-memory failures in any application that decodes untrusted images. The flaw stems from Pillow's JPEG2000 decoder summing tile widths across the whole image rather than per tile, so a small crafted tiled file forces disproportionately large transient allocations. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the upstream fix (12.3.0) and a public PR/commit make the root cause fully transparent.
Uncontrolled memory allocation in Python Pillow before 12.3.0 lets a crafted BDF font file exhaust available memory and crash the host application. The BdfFontFile parser trusts the attacker-supplied BBX width/height fields and hands them to Image.new() while skipping Pillow's decompression-bomb size check, so a tiny malicious font can request a huge in-memory bitmap. Impact is availability-only (denial of service); there is no public exploit identified at time of analysis and the issue is not in CISA KEV.
Denial-of-service via memory exhaustion in Python Pillow before 12.3.0 allows a crafted GD-format (.gd) image to trigger excessive C-heap allocation when opened, because GdImageFile._open() reads image dimensions straight from the GD 2.x header without invoking Pillow's Image._decompression_bomb_check() guard. Any application that loads untrusted .gd files with a vulnerable Pillow version can be crashed or driven into out-of-memory conditions. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 (availability-only impact).
Uncontrolled memory allocation in Python Pillow before 12.3.0 allows a maliciously crafted font file to trigger excessive memory consumption and denial of service when its glyphs are compiled into a combined bitmap. FontFile.compile() builds the output image via Image.new("1", (xsize, ysize)) without invoking Pillow's decompression-bomb guard, so oversized glyph dimensions are allocated unchecked during conversion or saving. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the availability-only impact (CVSS 7.5) reflects resource exhaustion rather than code execution or data disclosure.
Uncontrolled memory allocation in the Python Pillow imaging library (all versions prior to 12.3.0) allows a crafted PCF bitmap font to exhaust process memory and crash the host application. The PcfFontFile bitmap loader trusts attacker-supplied glyph dimensions from the font's METRICS section and hands them straight to Image.frombytes() while skipping Pillow's decompression-bomb guard. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the flaw is an availability-only denial of service (CVSS 7.5), not the information disclosure implied by the source tag.
Out-of-bounds write in Pillow versions 10.3.0 through 12.1.0 allows remote denial of service when processing maliciously crafted PSD image files. An attacker can trigger a crash by supplying a specially crafted image without authentication or user interaction. A patch is available in version 12.1.1.
Pillow 11.2.1 through 12.x can disclose uninitialized padding, bytes preceding the first row, or stale heap contents when an application sets a non-default PILLOW_ALIGNMENT and exports images through the Arrow C interface (__arrow_c_array__/__arrow_c_schema__). The flaw is limited to deployments that both customize alignment and use Arrow export, with meaningful cross-user exposure requiring a multi-user context where one user's exported buffer can reach another user; default Pillow configurations are not affected. No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor released Pillow 13.0.0 as the fix.
Integer underflow in Pillow's legacy PILfont text-width calculation (CVE-2026-96641, GHSA-4rm8-3hmm-39fg) can be triggered when an application loads and measures text with a manipulated .pil bitmap font, producing a low-impact availability condition; the Pillow project rates it Medium and fixed it in release 13.0.0. The assessed CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating a local attack vector, no privileges required, no user interaction, and impact limited to availability with no confidentiality or integrity effect. No public exploit was identified at time of analysis, and no CISA KEV entry is indicated in the available data.
Memory-amplification denial of service in Pillow's BMP RLE decoder (BI_RLE4/BI_RLE8) allows unauthenticated remote attackers to exhaust memory by delivering a small crafted BMP to any image pipeline that processes untrusted files with Pillow before 13.0.0. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is limited to availability with no code execution or information disclosure; the Pillow project classifies this issue as Medium severity. No public exploit code was identified at time of analysis, and exploitation requires the application to actually route attacker-supplied BMP data into Pillow's decoder.
Denial-of-service in Pillow's multi-frame image handling: the MAX_IMAGE_PIXELS decompression-bomb guard can be bypassed for MPO, DCX, and MIC containers when an application calls seek() to navigate to frames or pages beyond the first, allowing a small attacker-supplied file to trigger unbounded memory and CPU consumption. Only applications that open these specific multi-frame formats and seek past the first frame are affected; single-frame opens and first-frame-only pipelines are not. The flaw is rated CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (availability-only, no confidentiality or integrity impact), affects Pillow releases prior to 13.0.0, and no public exploit code was identified at time of analysis.
Regular-expression denial of service in Pillow before 13.0.0 lets unauthenticated remote attackers stall an image-processing worker by submitting a tiny crafted XBM file that triggers catastrophic backtracking in the XBM header parser before image dimensions are ever validated. Any service that routes untrusted uploads through Image.open() with XBM parsing reachable is affected; impact is confined to availability degradation of the decoding worker, with no code execution, data exposure, or integrity impact. The flaw is fixed in Pillow 13.0.0, which replaces the backtracking regex with line-based parsing; no public exploit tooling or confirmed active exploitation was identified at time of analysis, though the upstream fix commit includes a regression test that reproduces a minimal triggering input.
Uninitialized stack memory disclosure in Pillow 9.1.0 through 12.x allows an attacker who controls a palette image passed to Image.quantize(palette=p) to receive raw stack contents - including pointer addresses and stack-canary bytes - embedded as pixel indices in the returned PNG or GIF. Exploitation is not implicit in normal Pillow use: the application must expose the quantize-with-palette path to untrusted input and must accept an attacker-supplied palette whose palette data is empty (p.palette.palette == b""), which causes ImagingPaletteCacheUpdate() to leave its local cache array uninitialized before those bytes are emitted by the topalette() conversion path. The flaw yields confidentiality-only impact with no memory corruption or crash; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the vendor-released fix is Pillow 13.0.0.
Saving attacker-controlled images as GIF in Python Pillow 9.2.0 through 12.x can drive quadratic comment-header assembly and consume excessive CPU, delaying or denying service. The issue is reachable without authentication or user interaction (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N), but only when an application preserves a very large embedded GIF comment and re-encodes the image as GIF; impact is limited to availability. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and the vendor-released fix is Pillow 13.0.0.
Denial of service in Pillow 5.4.0 through pre-13.0.0 allows unauthenticated remote attackers to exhaust CPU by supplying a crafted GIF containing numerous comment extensions; Image.open() parses frame zero and triggers quadratic bytes copying in GifImageFile._seek() before the application can inspect the image. Impact is limited to availability (vendor CVSS 4.0 score 6.9; assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), with no code execution or data exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and environments that only open trusted images are not practically exposed.
Out-of-bounds heap read in Pillow prior to 13.0.0 lets unauthenticated remote attackers disclose up to three adjacent heap bytes or crash the process, but only when the application explicitly decodes attacker-controlled data using the uncommon planar palette raw modes P;2L or P;4L. This is a genuine but moderate-severity CWE-126 memory-safety defect rather than a top-tier priority: these raw modes are not reached by ordinary image-file opening or auto-detection, and impact is bounded to limited information disclosure or denial of service with no code execution or integrity loss. No public exploit identified at time of analysis; the provided intelligence contains no KEV listing and no POC reference.
Unbounded recursion in Pillow's PDF parser (versions 5.1.0 through 12.x) can crash a Python worker when an application opens an attacker-supplied PDF for append, producing availability-only denial of service. The issue is reachable only when the application explicitly uses Pillow's PDF append mode on untrusted input; the independent assessment rates it as a modest-priority availability issue, not a top-tier emergency, and no public exploit has been identified at time of analysis. Pillow 13.0.0 fixes the problem by capping parser nesting depth.
Command injection in Pillow's WindowsViewer component (all versions prior to 12.3.0) allows arbitrary cmd.exe command execution when a user opens an image with a crafted filename containing shell metacharacters. The root cause is in WindowsViewer.get_command(), which embeds an unsanitized file path directly into an f-string and passes the result to subprocess.Popen with shell=True on Windows. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0.
An issue was discovered in Pillow before 10.0.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Pillow before 8.2.0. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
An issue was discovered in Pillow before 8.2.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in Pillow before 8.2.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in Pillow before 8.2.0. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Pillow before 8.2.0. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Pillow before 8.2.0. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Pillow before 8.1.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Pillow before 8.1.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Pillow before 8.1.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Pillow before 8.1.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Pillow before 8.1.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in Pillow before 6.2.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer Overflow" issue affecting the. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.