Python Pillow
Monthly
Argument injection in Pillow's EPS decoding path (EpsImagePlugin.Ghostscript) lets a caller-controlled input filename be parsed as a Ghostscript option, and in the worst case escalates to arbitrary command execution. All Pillow releases from 2.6.0 up to but not including 13.0.0 are affected when Ghostscript is installed and the host application passes an unsanitized, attacker-influenced filename into Image.open() for EPS input; no authentication is required per the CVSS vector (PR:N), though exploitation depends on that application-level precondition. Making the path absolute before it is placed after Ghostscript's -f flag closes the issue, and the vendor shipped that change in 13.0.0 (commit a2c3631); no public exploit code or confirmed active exploitation was identified at time of analysis.
Uninitialized heap memory disclosure in Pillow 5.3.0 through 12.x allows remote attackers to read stale process memory by supplying a crafted TIFF that uses JPEG (COMPRESSION=7) or Group 4 fax compression and triggers a libtiff 'short decode', after which the library converts rows from a buffer whose unwritten tail was never cleared. The tile decode path has been affected since 5.3.0 and the strip path since 6.0.0, and the impact is confidentiality-only (memory disclosure with no corruption, crash, or code execution) - an application is only exposed if it both decodes the attacker-supplied image and returns or re-encodes the resulting pixel data, since that output channel is the only way the stale bytes reach the attacker. No public exploit code or active exploitation is indicated in the available data, and the issue is fixed in Pillow 13.0.0.
Out-of-bounds read in Pillow's TIFF encoder before 13.0.0 allows unauthenticated remote attackers to leak heap memory or cause a denial of service (process crash) when an application saves or re-encodes a malicious TIFF using the libtiff encoder. Exploitation requires the target to re-encode the attacker-supplied image-simply opening it does not trigger the bug-and the leak is limited to adjacent heap bytes rather than targeted data. No public exploit has been identified at time of analysis, and the vendor has released Pillow 13.0.0 to fix the issue.
Denial of service in Pillow (Python imaging library) versions 5.1.0 through 12.x allows remote attackers to crash or hang applications that append images to attacker-influenced PDFs. PdfParser lacks cycle and duplication tracking when following page-tree /Kids references and only guards against exact repeated trailer offsets, so a crafted PDF with a deep or cyclic page tree, repeated non-cyclic /Kids entries, or a long chain of unique previous-trailer offsets can raise an uncaught RecursionError or drive super-linear CPU and memory consumption before any output is written. Exploitation requires the target application to call Image.save with PDF append enabled against a PDF the attacker can supply; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though the availability-only impact and trivial prerequisites justify prompt patching to 13.0.0.
Denial of service in Pillow 5.1.0 through 12.x: when an application uses Image.save with save_all=True to convert a multi-frame image (APNG, GIF, TIFF) into a multipage PDF, PdfParser.next_object_id() rebuilds and rescans the entire set of previously reserved PDF object identifiers for every object, producing quadratic runtime in the number of frames. Because the cost scales with the declared frame count, an unauthenticated remote attacker can submit a very small APNG that advertises a huge number of frames and exhaust CPU on the converting service. Active exploitation has not been confirmed (no CISA KEV listing) and no public exploit code was identified at time of analysis, but the trigger is trivial for anyone who can reach an image-to-PDF conversion workflow; the vendor fixed it in Pillow 13.0.0 via GHSA-jg86-v3jv-hrpm.
Pillow versions 10.0.0 through 12.x can free an invalid glyph pointer during FreeType text rendering when an active stroker is used, allowing malformed font bytes supplied by an attacker to corrupt memory or crash the process. Exploitation requires the application to render text with a nonzero stroke width and load an attacker-controlled font from untrusted bytes; no authentication or user interaction is required on the application side, but the attack requirements are present because the stroking path must be enabled. There is no CISA KEV confirmation and no public exploit identified at time of analysis; the issue is fixed in Pillow 13.0.0.
Memory exhaustion denial of service in Pillow 4.1.0 through 12.x allows unauthenticated remote attackers to exhaust server memory when an application decodes a crafted MSP image and loads its pixels. The MSP RLE decoder writes expanded run-length output into an in-memory buffer without limiting it to the declared image dimensions, bypassing Pillow's decompression-bomb pixel-count guard; no public exploit identified at time of analysis.
Denial of service in Pillow 5.1.0 through versions before 13.0.0 allows unauthenticated remote attackers to exhaust a processing worker's CPU by supplying a crafted PDF whose page tree contains a Parent-reference cycle when an application uses Pillow to append an image to that PDF. The flaw is an uncontrolled infinite loop in PdfParser.rewrite_pages(), giving availability-only impact with no confidentiality or integrity effect. Vendor-released patch: 13.0.0; no public exploit identified at time of analysis.
Denial of service in Pillow 12.0.0 through 12.x lets unauthenticated remote attackers crash a Python process by supplying a crafted IPTC image that reaches Image.merge(), or by calling Image.merge() with an I/F first band backed by image32 storage. The flaw is a null-pointer dereference (CWE-476) with high availability impact but no confidentiality or integrity impact; it is fixed in 13.0.0 and no public exploit was identified at time of analysis.
Heap out-of-bounds over-read in Pillow 8.1.0 through 12.x allows a crafted TIFF processed by an application using libtiff-backed decoding to copy adjacent heap contents into output pixels or crash the process. The flaw affects the tile path in _decodeTile and the RGBA unpacker when duplicated PhotometricInterpretation or BitsPerSample tags are interpreted differently by Pillow and libtiff; the strip path is not affected. No public exploit code or CISA KEV entry was identified at time of analysis, and upgrading to 13.0.0 fixes the issue.
Heap buffer overflow in Pillow's JPEG decoder (all versions prior to 13.0.0) lets a crafted 8-bit lossless SOF3 JPEG corrupt heap memory, crash the process, and potentially achieve code execution when an application requests downscaling through draft() or thumbnail(). Exploitation is unauthenticated but conditional: the Pillow build must be linked against libjpeg-turbo 3.x, because libjpeg-turbo 2.x and IJG builds reject the SOF3 input outright, and the application must actually call draft()/thumbnail() on attacker-supplied images - a common pattern in upload/thumbnail pipelines, which is the realistic exposure surface. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the CVSS 4.0 score of 9.2 reflects high confidentiality/integrity/availability impact, tempered by the AC:H rating derived from the narrow build-configuration prerequisite.
Memory corruption in Pillow versions prior to 13.0.0 can crash the process when Image.transform() takes the fast Transform.EXTENT or pure scale-and-translate Transform.AFFINE path with default NEAREST resampling and a selective allocation failure occurs under memory pressure. The defect is a double free/use-after-free in ImagingScaleAffine: the output image allocation succeeds, the additional per-column lookup allocation fails, and the error path deletes image storage that later cleanup releases again (CWE-416). The assessed impact is availability-only with no confidentiality or integrity effect, exploitation depends on attacker-influenced transform sizes plus genuine memory pressure, and no public exploit identified at time of analysis.
Process crash in Pillow before 13.0.0 can be triggered when an application decodes an attacker-supplied PPM or PGM image with zero width and then applies an ImageMorph morphology operation. The flaw is an out-of-bounds memory access in the native morphology routine, and unauthenticated remote attackers can exploit it only when that specific ImageMorph code path is used, resulting in denial of service rather than data exposure or code execution. Vendor-released patch: 13.0.0; no public exploit identified at time of analysis.
Denial of service in Pillow prior to 13.0.0 occurs when ImageFilter.RankFilter, MedianFilter, MinFilter, or MaxFilter is applied to a zero-width or zero-height image, triggering a native null pointer dereference during edge expansion and crashing the process. Remote, unauthenticated attackers who can supply or cause creation of such a zero-dimension image to an application that uses these rank filters can cause high availability impact only (C:N/I:N/A:H per the assessed CVSS 3.1 vector; official CVSS 4.0 score 8.2 with AT:P). No public exploit code or confirmed active exploitation is identified at time of analysis, and no EPSS data was provided.
Memory exhaustion denial of service in Pillow 9.2.0 through pre-13.0.0 can be triggered by a crafted multi-frame GIF that leaves rejected, oversized frame dimensions stored after Image.DecompressionBombError is raised. The flaw is exploitable only in applications that catch that exception and then continue calling seek() or load() on the same GifImageFile object; applications that let the exception propagate or discard the image object are not affected. It is an availability-only issue, with no public exploit identified at time of analysis and no CISA KEV confirmation.
Memory exhaustion in Pillow 8.1.0 through 12.x allows unauthenticated remote attackers to cause denial of service by supplying a crafted APNG that triggers a full-canvas background allocation inside Image.open() before the decompression-bomb check. The flaw is reachable when an application parses untrusted images with an affected version; no pixel loading, frame iteration, authentication, or user interaction is required. No public exploit code or CISA KEV entry was identified at time of analysis, but the availability impact is high (CVSS 8.7; assessed CVSS:3.1 A:H).
Heap-based buffer overflow in Pillow before 13.0.0 can corrupt memory and potentially enable arbitrary code execution when an application with the optional olefile dependency opens or thumbnails a crafted OLE2 FlashPix (FPX) image. The flaw is reachable by unauthenticated remote attackers who can supply malicious image input, but exposure is limited to deployments that have installed olefile and process untrusted FPX content; no public exploit identified at time of analysis, and no confirmed active exploitation (CISA KEV). The vendor-released patch is Pillow 13.0.0.
Heap buffer overflow and stale-heap disclosure in Pillow's compressed TIFF save path can crash the process and potentially enable code execution when an application writes TIFF data to an in-memory stream such as io.BytesIO. Affected are Pillow versions 2.0.0 through 12.x (fixed in 13.0.0) that use libtiff and process attacker-influenced out-of-line TIFF tags or retained ICC profiles; file paths and targets with real file descriptors are not affected. The flaw requires a specific combination of compressed saving, seek-past-end behavior, and controlled tag data (AC:H/AT:P), and no public exploit code has been identified at time of analysis.
Pillow versions 7.2.0 through 12.x can hang indefinitely at full CPU when an application reads n_frames or saves all frames from a crafted MIC image; MicImageFile inherits TIFF frame traversal but its tell() reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances the traversal. The attacker only needs to supply the MIC file, but exploitation requires the optional olefile package to be installed and the application to invoke the frame-count or save-all code path - default Pillow installs that never touch MIC frames are unaffected. Impact is confined to availability (CWE-835 uncontrolled loop, no confidentiality or integrity effect); vendor-released patch: 13.0.0.
Out-of-bounds memory disclosure in Python Pillow before 12.3.0 lets an attacker who supplies a crafted McIdas AREA image file read adjacent process memory or crash the host application. When such a file is opened from a filename, header words control the raw-codec mmap row stride; setting it below the true row width causes later pixel operations (tobytes, getpixel, convert, save) to read past the mapped region. No public exploit is identified at time of analysis and it is not in CISA KEV, but the upstream fix, PR, and a regression test are public, making the flaw well documented.
Heap out-of-bounds write in Python Pillow prior to 12.3.0 lets an attacker who controls the rank-filter size parameter corrupt native heap memory and crash or potentially manipulate the process. ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before validating the filter size, and the native ImagingExpand() routine computes output dimensions using unchecked signed-int arithmetic, so a very large odd size overflows and drives an out-of-bounds write (CWE-787). No public exploit is identified at time of analysis; the flaw is fixed in Pillow 12.3.0.
Uncontrolled memory consumption in Python Pillow (PIL) versions 5.1.0 through 12.2.x allows a remote attacker to cause denial of service by supplying a small crafted PDF whose FlateDecode stream declares a large Length; PdfParser.PdfStream.decode() passes this attacker-controlled Length straight to zlib.decompress() as the bufsize with no upper bound, so a tiny file inflates into gigabytes of decompressed data and exhausts host memory. Fixed in 12.3.0 by streaming decompression with a bounded max_length. No public exploit identified at time of analysis and this CVE is not in CISA KEV, but the trigger is trivial to construct.
Out-of-bounds heap read in Python Pillow's TGA RLE encoder (versions 5.2.0 through 12.2.x) lets adjacent process heap bytes leak into a generated TGA file when an application saves a mode '1' (1-bit) image using compression='tga_rle'. The flaw is an information-disclosure bug (CWE-125), fixed in 12.3.0, with no public exploit identified at time of analysis. The NVD CVSS of 7.5 (network vector) overstates practical reach because triggering the leak depends on the host application invoking this specific and unusual save path.
Denial-of-service and controlled heap corruption in Python's Pillow imaging library (all versions prior to 12.3.0) occurs when ImageCms.ImageCmsTransform.apply() is invoked with an output image whose mode does not match the transform's declared output mode, causing an out-of-bounds write in the native color-management code. The pre-fix code only validated the output mode and never validated the input mode, so a mismatched buffer geometry lets the C-level transform write past allocation bounds. No public exploit has been identified at time of analysis; the fix is confirmed in release 12.3.0 via the vendor security advisory GHSA-9hw9-ch79-4vh6.
Denial of service in Python Pillow 12.0.0 through 12.2.0 lets a remote attacker hang an application by supplying a crafted EPS image whose %%BeginBinary directive declares a negative byte count, causing the EPS parser to seek backwards and re-parse the same directive forever. Any service that calls Image.open() on attacker-supplied EPS data is affected until upgraded to 12.3.0. No public exploit identified at time of analysis, though the upstream fix PR includes a test reproducer; the flaw is not listed in CISA KEV.
Denial of service (and potential memory corruption) in Python Pillow before 12.3.0 arises when public image coordinate APIs - Image.paste(), Image.crop(), and Image.alpha_composite() - are handed box coordinates near the signed 32-bit integer boundary (±2**31), causing a native heap out-of-bounds write in the C imaging core. Any application that forwards untrusted coordinate values into these calls can be crashed, and the OOB write raises the theoretical prospect of heap corruption. No public exploit identified at time of analysis; the fix (integer-overflow-safe int64_t arithmetic) shipped in 12.3.0.
Denial of service in Python Pillow (versions 8.2.0 through 12.2.0) allows remote attackers to exhaust memory during JPEG2000 decoding, causing out-of-memory failures in any application that decodes untrusted images. The flaw stems from Pillow's JPEG2000 decoder summing tile widths across the whole image rather than per tile, so a small crafted tiled file forces disproportionately large transient allocations. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the upstream fix (12.3.0) and a public PR/commit make the root cause fully transparent.
Uncontrolled memory allocation in Python Pillow before 12.3.0 lets a crafted BDF font file exhaust available memory and crash the host application. The BdfFontFile parser trusts the attacker-supplied BBX width/height fields and hands them to Image.new() while skipping Pillow's decompression-bomb size check, so a tiny malicious font can request a huge in-memory bitmap. Impact is availability-only (denial of service); there is no public exploit identified at time of analysis and the issue is not in CISA KEV.
Denial-of-service via memory exhaustion in Python Pillow before 12.3.0 allows a crafted GD-format (.gd) image to trigger excessive C-heap allocation when opened, because GdImageFile._open() reads image dimensions straight from the GD 2.x header without invoking Pillow's Image._decompression_bomb_check() guard. Any application that loads untrusted .gd files with a vulnerable Pillow version can be crashed or driven into out-of-memory conditions. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 (availability-only impact).
Uncontrolled memory allocation in Python Pillow before 12.3.0 allows a maliciously crafted font file to trigger excessive memory consumption and denial of service when its glyphs are compiled into a combined bitmap. FontFile.compile() builds the output image via Image.new("1", (xsize, ysize)) without invoking Pillow's decompression-bomb guard, so oversized glyph dimensions are allocated unchecked during conversion or saving. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the availability-only impact (CVSS 7.5) reflects resource exhaustion rather than code execution or data disclosure.
Uncontrolled memory allocation in the Python Pillow imaging library (all versions prior to 12.3.0) allows a crafted PCF bitmap font to exhaust process memory and crash the host application. The PcfFontFile bitmap loader trusts attacker-supplied glyph dimensions from the font's METRICS section and hands them straight to Image.frombytes() while skipping Pillow's decompression-bomb guard. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the flaw is an availability-only denial of service (CVSS 7.5), not the information disclosure implied by the source tag.
Pillow 11.2.1 through 12.x can disclose uninitialized padding, bytes preceding the first row, or stale heap contents when an application sets a non-default PILLOW_ALIGNMENT and exports images through the Arrow C interface (__arrow_c_array__/__arrow_c_schema__). The flaw is limited to deployments that both customize alignment and use Arrow export, with meaningful cross-user exposure requiring a multi-user context where one user's exported buffer can reach another user; default Pillow configurations are not affected. No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor released Pillow 13.0.0 as the fix.
Regular-expression denial of service in Pillow before 13.0.0 lets unauthenticated remote attackers stall an image-processing worker by submitting a tiny crafted XBM file that triggers catastrophic backtracking in the XBM header parser before image dimensions are ever validated. Any service that routes untrusted uploads through Image.open() with XBM parsing reachable is affected; impact is confined to availability degradation of the decoding worker, with no code execution, data exposure, or integrity impact. The flaw is fixed in Pillow 13.0.0, which replaces the backtracking regex with line-based parsing; no public exploit tooling or confirmed active exploitation was identified at time of analysis, though the upstream fix commit includes a regression test that reproduces a minimal triggering input.
Uninitialized stack memory disclosure in Pillow 9.1.0 through 12.x allows an attacker who controls a palette image passed to Image.quantize(palette=p) to receive raw stack contents - including pointer addresses and stack-canary bytes - embedded as pixel indices in the returned PNG or GIF. Exploitation is not implicit in normal Pillow use: the application must expose the quantize-with-palette path to untrusted input and must accept an attacker-supplied palette whose palette data is empty (p.palette.palette == b""), which causes ImagingPaletteCacheUpdate() to leave its local cache array uninitialized before those bytes are emitted by the topalette() conversion path. The flaw yields confidentiality-only impact with no memory corruption or crash; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the vendor-released fix is Pillow 13.0.0.
Saving attacker-controlled images as GIF in Python Pillow 9.2.0 through 12.x can drive quadratic comment-header assembly and consume excessive CPU, delaying or denying service. The issue is reachable without authentication or user interaction (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N), but only when an application preserves a very large embedded GIF comment and re-encodes the image as GIF; impact is limited to availability. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and the vendor-released fix is Pillow 13.0.0.
Denial of service in Pillow 5.4.0 through pre-13.0.0 allows unauthenticated remote attackers to exhaust CPU by supplying a crafted GIF containing numerous comment extensions; Image.open() parses frame zero and triggers quadratic bytes copying in GifImageFile._seek() before the application can inspect the image. Impact is limited to availability (vendor CVSS 4.0 score 6.9; assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), with no code execution or data exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and environments that only open trusted images are not practically exposed.
Heap use-after-free in Pillow 11.3.0 through 12.x can crash any Python process that encodes TIFF data into an in-memory buffer while an attacker influences the TIFF tags being written. When an application saves to BytesIO with a tiffinfo dictionary containing a tag libtiff rejects during encoding - the documented trigger is a floating-point predictor (PREDICTOR=3) applied to integer sample data - TIFFWriteScanline fails inside ImagingLibTiffEncode, the error path frees the output buffer without closing the TIFF handle, and a later cleanup flushes buffered bytes through the write callback into freed memory. The vector (CVSS 5.9, AV:N/AC:H/PR:N/UI:N, C:N/I:N/A:H) reflects unauthenticated but configuration-dependent reachability: exploitation needs the memory-buffer code path plus attacker-controlled tag values, and the reliable outcome is process termination, with code execution unproven; no public exploit identified at time of analysis, and the upstream fix commit ships a regression test rather than weaponized tooling.
Heap out-of-bounds read in Pillow's tiled-TIFF decoder (versions 8.2.0 through 12.x) lets a crafted TIFF file cause the stride-and-copy loop in _decodeTile to walk past the buffer libtiff allocated, potentially exposing adjacent heap contents in the returned pixel data or crashing the process. Any application that opens untrusted TIFF images with an affected Pillow build is exposed without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, 6.5), though impact is bounded to partial confidentiality loss and partial availability loss with no write primitive. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fix in 13.0.0 makes the decoder reject the triggering images with 'decoder error -2'.
Out-of-bounds heap read in Pillow prior to 13.0.0 lets unauthenticated remote attackers disclose up to three adjacent heap bytes or crash the process, but only when the application explicitly decodes attacker-controlled data using the uncommon planar palette raw modes P;2L or P;4L. This is a genuine but moderate-severity CWE-126 memory-safety defect rather than a top-tier priority: these raw modes are not reached by ordinary image-file opening or auto-detection, and impact is bounded to limited information disclosure or denial of service with no code execution or integrity loss. No public exploit identified at time of analysis; the provided intelligence contains no KEV listing and no POC reference.
Unbounded recursion in Pillow's PDF parser (versions 5.1.0 through 12.x) can crash a Python worker when an application opens an attacker-supplied PDF for append, producing availability-only denial of service. The issue is reachable only when the application explicitly uses Pillow's PDF append mode on untrusted input; the independent assessment rates it as a modest-priority availability issue, not a top-tier emergency, and no public exploit has been identified at time of analysis. Pillow 13.0.0 fixes the problem by capping parser nesting depth.
Command injection in Pillow's WindowsViewer component (all versions prior to 12.3.0) allows arbitrary cmd.exe command execution when a user opens an image with a crafted filename containing shell metacharacters. The root cause is in WindowsViewer.get_command(), which embeds an unsanitized file path directly into an f-string and passes the result to subprocess.Popen with shell=True on Windows. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Argument injection in Pillow's EPS decoding path (EpsImagePlugin.Ghostscript) lets a caller-controlled input filename be parsed as a Ghostscript option, and in the worst case escalates to arbitrary command execution. All Pillow releases from 2.6.0 up to but not including 13.0.0 are affected when Ghostscript is installed and the host application passes an unsanitized, attacker-influenced filename into Image.open() for EPS input; no authentication is required per the CVSS vector (PR:N), though exploitation depends on that application-level precondition. Making the path absolute before it is placed after Ghostscript's -f flag closes the issue, and the vendor shipped that change in 13.0.0 (commit a2c3631); no public exploit code or confirmed active exploitation was identified at time of analysis.
Uninitialized heap memory disclosure in Pillow 5.3.0 through 12.x allows remote attackers to read stale process memory by supplying a crafted TIFF that uses JPEG (COMPRESSION=7) or Group 4 fax compression and triggers a libtiff 'short decode', after which the library converts rows from a buffer whose unwritten tail was never cleared. The tile decode path has been affected since 5.3.0 and the strip path since 6.0.0, and the impact is confidentiality-only (memory disclosure with no corruption, crash, or code execution) - an application is only exposed if it both decodes the attacker-supplied image and returns or re-encodes the resulting pixel data, since that output channel is the only way the stale bytes reach the attacker. No public exploit code or active exploitation is indicated in the available data, and the issue is fixed in Pillow 13.0.0.
Out-of-bounds read in Pillow's TIFF encoder before 13.0.0 allows unauthenticated remote attackers to leak heap memory or cause a denial of service (process crash) when an application saves or re-encodes a malicious TIFF using the libtiff encoder. Exploitation requires the target to re-encode the attacker-supplied image-simply opening it does not trigger the bug-and the leak is limited to adjacent heap bytes rather than targeted data. No public exploit has been identified at time of analysis, and the vendor has released Pillow 13.0.0 to fix the issue.
Denial of service in Pillow (Python imaging library) versions 5.1.0 through 12.x allows remote attackers to crash or hang applications that append images to attacker-influenced PDFs. PdfParser lacks cycle and duplication tracking when following page-tree /Kids references and only guards against exact repeated trailer offsets, so a crafted PDF with a deep or cyclic page tree, repeated non-cyclic /Kids entries, or a long chain of unique previous-trailer offsets can raise an uncaught RecursionError or drive super-linear CPU and memory consumption before any output is written. Exploitation requires the target application to call Image.save with PDF append enabled against a PDF the attacker can supply; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though the availability-only impact and trivial prerequisites justify prompt patching to 13.0.0.
Denial of service in Pillow 5.1.0 through 12.x: when an application uses Image.save with save_all=True to convert a multi-frame image (APNG, GIF, TIFF) into a multipage PDF, PdfParser.next_object_id() rebuilds and rescans the entire set of previously reserved PDF object identifiers for every object, producing quadratic runtime in the number of frames. Because the cost scales with the declared frame count, an unauthenticated remote attacker can submit a very small APNG that advertises a huge number of frames and exhaust CPU on the converting service. Active exploitation has not been confirmed (no CISA KEV listing) and no public exploit code was identified at time of analysis, but the trigger is trivial for anyone who can reach an image-to-PDF conversion workflow; the vendor fixed it in Pillow 13.0.0 via GHSA-jg86-v3jv-hrpm.
Pillow versions 10.0.0 through 12.x can free an invalid glyph pointer during FreeType text rendering when an active stroker is used, allowing malformed font bytes supplied by an attacker to corrupt memory or crash the process. Exploitation requires the application to render text with a nonzero stroke width and load an attacker-controlled font from untrusted bytes; no authentication or user interaction is required on the application side, but the attack requirements are present because the stroking path must be enabled. There is no CISA KEV confirmation and no public exploit identified at time of analysis; the issue is fixed in Pillow 13.0.0.
Memory exhaustion denial of service in Pillow 4.1.0 through 12.x allows unauthenticated remote attackers to exhaust server memory when an application decodes a crafted MSP image and loads its pixels. The MSP RLE decoder writes expanded run-length output into an in-memory buffer without limiting it to the declared image dimensions, bypassing Pillow's decompression-bomb pixel-count guard; no public exploit identified at time of analysis.
Denial of service in Pillow 5.1.0 through versions before 13.0.0 allows unauthenticated remote attackers to exhaust a processing worker's CPU by supplying a crafted PDF whose page tree contains a Parent-reference cycle when an application uses Pillow to append an image to that PDF. The flaw is an uncontrolled infinite loop in PdfParser.rewrite_pages(), giving availability-only impact with no confidentiality or integrity effect. Vendor-released patch: 13.0.0; no public exploit identified at time of analysis.
Denial of service in Pillow 12.0.0 through 12.x lets unauthenticated remote attackers crash a Python process by supplying a crafted IPTC image that reaches Image.merge(), or by calling Image.merge() with an I/F first band backed by image32 storage. The flaw is a null-pointer dereference (CWE-476) with high availability impact but no confidentiality or integrity impact; it is fixed in 13.0.0 and no public exploit was identified at time of analysis.
Heap out-of-bounds over-read in Pillow 8.1.0 through 12.x allows a crafted TIFF processed by an application using libtiff-backed decoding to copy adjacent heap contents into output pixels or crash the process. The flaw affects the tile path in _decodeTile and the RGBA unpacker when duplicated PhotometricInterpretation or BitsPerSample tags are interpreted differently by Pillow and libtiff; the strip path is not affected. No public exploit code or CISA KEV entry was identified at time of analysis, and upgrading to 13.0.0 fixes the issue.
Heap buffer overflow in Pillow's JPEG decoder (all versions prior to 13.0.0) lets a crafted 8-bit lossless SOF3 JPEG corrupt heap memory, crash the process, and potentially achieve code execution when an application requests downscaling through draft() or thumbnail(). Exploitation is unauthenticated but conditional: the Pillow build must be linked against libjpeg-turbo 3.x, because libjpeg-turbo 2.x and IJG builds reject the SOF3 input outright, and the application must actually call draft()/thumbnail() on attacker-supplied images - a common pattern in upload/thumbnail pipelines, which is the realistic exposure surface. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the CVSS 4.0 score of 9.2 reflects high confidentiality/integrity/availability impact, tempered by the AC:H rating derived from the narrow build-configuration prerequisite.
Memory corruption in Pillow versions prior to 13.0.0 can crash the process when Image.transform() takes the fast Transform.EXTENT or pure scale-and-translate Transform.AFFINE path with default NEAREST resampling and a selective allocation failure occurs under memory pressure. The defect is a double free/use-after-free in ImagingScaleAffine: the output image allocation succeeds, the additional per-column lookup allocation fails, and the error path deletes image storage that later cleanup releases again (CWE-416). The assessed impact is availability-only with no confidentiality or integrity effect, exploitation depends on attacker-influenced transform sizes plus genuine memory pressure, and no public exploit identified at time of analysis.
Process crash in Pillow before 13.0.0 can be triggered when an application decodes an attacker-supplied PPM or PGM image with zero width and then applies an ImageMorph morphology operation. The flaw is an out-of-bounds memory access in the native morphology routine, and unauthenticated remote attackers can exploit it only when that specific ImageMorph code path is used, resulting in denial of service rather than data exposure or code execution. Vendor-released patch: 13.0.0; no public exploit identified at time of analysis.
Denial of service in Pillow prior to 13.0.0 occurs when ImageFilter.RankFilter, MedianFilter, MinFilter, or MaxFilter is applied to a zero-width or zero-height image, triggering a native null pointer dereference during edge expansion and crashing the process. Remote, unauthenticated attackers who can supply or cause creation of such a zero-dimension image to an application that uses these rank filters can cause high availability impact only (C:N/I:N/A:H per the assessed CVSS 3.1 vector; official CVSS 4.0 score 8.2 with AT:P). No public exploit code or confirmed active exploitation is identified at time of analysis, and no EPSS data was provided.
Memory exhaustion denial of service in Pillow 9.2.0 through pre-13.0.0 can be triggered by a crafted multi-frame GIF that leaves rejected, oversized frame dimensions stored after Image.DecompressionBombError is raised. The flaw is exploitable only in applications that catch that exception and then continue calling seek() or load() on the same GifImageFile object; applications that let the exception propagate or discard the image object are not affected. It is an availability-only issue, with no public exploit identified at time of analysis and no CISA KEV confirmation.
Memory exhaustion in Pillow 8.1.0 through 12.x allows unauthenticated remote attackers to cause denial of service by supplying a crafted APNG that triggers a full-canvas background allocation inside Image.open() before the decompression-bomb check. The flaw is reachable when an application parses untrusted images with an affected version; no pixel loading, frame iteration, authentication, or user interaction is required. No public exploit code or CISA KEV entry was identified at time of analysis, but the availability impact is high (CVSS 8.7; assessed CVSS:3.1 A:H).
Heap-based buffer overflow in Pillow before 13.0.0 can corrupt memory and potentially enable arbitrary code execution when an application with the optional olefile dependency opens or thumbnails a crafted OLE2 FlashPix (FPX) image. The flaw is reachable by unauthenticated remote attackers who can supply malicious image input, but exposure is limited to deployments that have installed olefile and process untrusted FPX content; no public exploit identified at time of analysis, and no confirmed active exploitation (CISA KEV). The vendor-released patch is Pillow 13.0.0.
Heap buffer overflow and stale-heap disclosure in Pillow's compressed TIFF save path can crash the process and potentially enable code execution when an application writes TIFF data to an in-memory stream such as io.BytesIO. Affected are Pillow versions 2.0.0 through 12.x (fixed in 13.0.0) that use libtiff and process attacker-influenced out-of-line TIFF tags or retained ICC profiles; file paths and targets with real file descriptors are not affected. The flaw requires a specific combination of compressed saving, seek-past-end behavior, and controlled tag data (AC:H/AT:P), and no public exploit code has been identified at time of analysis.
Pillow versions 7.2.0 through 12.x can hang indefinitely at full CPU when an application reads n_frames or saves all frames from a crafted MIC image; MicImageFile inherits TIFF frame traversal but its tell() reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances the traversal. The attacker only needs to supply the MIC file, but exploitation requires the optional olefile package to be installed and the application to invoke the frame-count or save-all code path - default Pillow installs that never touch MIC frames are unaffected. Impact is confined to availability (CWE-835 uncontrolled loop, no confidentiality or integrity effect); vendor-released patch: 13.0.0.
Out-of-bounds memory disclosure in Python Pillow before 12.3.0 lets an attacker who supplies a crafted McIdas AREA image file read adjacent process memory or crash the host application. When such a file is opened from a filename, header words control the raw-codec mmap row stride; setting it below the true row width causes later pixel operations (tobytes, getpixel, convert, save) to read past the mapped region. No public exploit is identified at time of analysis and it is not in CISA KEV, but the upstream fix, PR, and a regression test are public, making the flaw well documented.
Heap out-of-bounds write in Python Pillow prior to 12.3.0 lets an attacker who controls the rank-filter size parameter corrupt native heap memory and crash or potentially manipulate the process. ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before validating the filter size, and the native ImagingExpand() routine computes output dimensions using unchecked signed-int arithmetic, so a very large odd size overflows and drives an out-of-bounds write (CWE-787). No public exploit is identified at time of analysis; the flaw is fixed in Pillow 12.3.0.
Uncontrolled memory consumption in Python Pillow (PIL) versions 5.1.0 through 12.2.x allows a remote attacker to cause denial of service by supplying a small crafted PDF whose FlateDecode stream declares a large Length; PdfParser.PdfStream.decode() passes this attacker-controlled Length straight to zlib.decompress() as the bufsize with no upper bound, so a tiny file inflates into gigabytes of decompressed data and exhausts host memory. Fixed in 12.3.0 by streaming decompression with a bounded max_length. No public exploit identified at time of analysis and this CVE is not in CISA KEV, but the trigger is trivial to construct.
Out-of-bounds heap read in Python Pillow's TGA RLE encoder (versions 5.2.0 through 12.2.x) lets adjacent process heap bytes leak into a generated TGA file when an application saves a mode '1' (1-bit) image using compression='tga_rle'. The flaw is an information-disclosure bug (CWE-125), fixed in 12.3.0, with no public exploit identified at time of analysis. The NVD CVSS of 7.5 (network vector) overstates practical reach because triggering the leak depends on the host application invoking this specific and unusual save path.
Denial-of-service and controlled heap corruption in Python's Pillow imaging library (all versions prior to 12.3.0) occurs when ImageCms.ImageCmsTransform.apply() is invoked with an output image whose mode does not match the transform's declared output mode, causing an out-of-bounds write in the native color-management code. The pre-fix code only validated the output mode and never validated the input mode, so a mismatched buffer geometry lets the C-level transform write past allocation bounds. No public exploit has been identified at time of analysis; the fix is confirmed in release 12.3.0 via the vendor security advisory GHSA-9hw9-ch79-4vh6.
Denial of service in Python Pillow 12.0.0 through 12.2.0 lets a remote attacker hang an application by supplying a crafted EPS image whose %%BeginBinary directive declares a negative byte count, causing the EPS parser to seek backwards and re-parse the same directive forever. Any service that calls Image.open() on attacker-supplied EPS data is affected until upgraded to 12.3.0. No public exploit identified at time of analysis, though the upstream fix PR includes a test reproducer; the flaw is not listed in CISA KEV.
Denial of service (and potential memory corruption) in Python Pillow before 12.3.0 arises when public image coordinate APIs - Image.paste(), Image.crop(), and Image.alpha_composite() - are handed box coordinates near the signed 32-bit integer boundary (±2**31), causing a native heap out-of-bounds write in the C imaging core. Any application that forwards untrusted coordinate values into these calls can be crashed, and the OOB write raises the theoretical prospect of heap corruption. No public exploit identified at time of analysis; the fix (integer-overflow-safe int64_t arithmetic) shipped in 12.3.0.
Denial of service in Python Pillow (versions 8.2.0 through 12.2.0) allows remote attackers to exhaust memory during JPEG2000 decoding, causing out-of-memory failures in any application that decodes untrusted images. The flaw stems from Pillow's JPEG2000 decoder summing tile widths across the whole image rather than per tile, so a small crafted tiled file forces disproportionately large transient allocations. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the upstream fix (12.3.0) and a public PR/commit make the root cause fully transparent.
Uncontrolled memory allocation in Python Pillow before 12.3.0 lets a crafted BDF font file exhaust available memory and crash the host application. The BdfFontFile parser trusts the attacker-supplied BBX width/height fields and hands them to Image.new() while skipping Pillow's decompression-bomb size check, so a tiny malicious font can request a huge in-memory bitmap. Impact is availability-only (denial of service); there is no public exploit identified at time of analysis and the issue is not in CISA KEV.
Denial-of-service via memory exhaustion in Python Pillow before 12.3.0 allows a crafted GD-format (.gd) image to trigger excessive C-heap allocation when opened, because GdImageFile._open() reads image dimensions straight from the GD 2.x header without invoking Pillow's Image._decompression_bomb_check() guard. Any application that loads untrusted .gd files with a vulnerable Pillow version can be crashed or driven into out-of-memory conditions. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 (availability-only impact).
Uncontrolled memory allocation in Python Pillow before 12.3.0 allows a maliciously crafted font file to trigger excessive memory consumption and denial of service when its glyphs are compiled into a combined bitmap. FontFile.compile() builds the output image via Image.new("1", (xsize, ysize)) without invoking Pillow's decompression-bomb guard, so oversized glyph dimensions are allocated unchecked during conversion or saving. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the availability-only impact (CVSS 7.5) reflects resource exhaustion rather than code execution or data disclosure.
Uncontrolled memory allocation in the Python Pillow imaging library (all versions prior to 12.3.0) allows a crafted PCF bitmap font to exhaust process memory and crash the host application. The PcfFontFile bitmap loader trusts attacker-supplied glyph dimensions from the font's METRICS section and hands them straight to Image.frombytes() while skipping Pillow's decompression-bomb guard. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the flaw is an availability-only denial of service (CVSS 7.5), not the information disclosure implied by the source tag.
Pillow 11.2.1 through 12.x can disclose uninitialized padding, bytes preceding the first row, or stale heap contents when an application sets a non-default PILLOW_ALIGNMENT and exports images through the Arrow C interface (__arrow_c_array__/__arrow_c_schema__). The flaw is limited to deployments that both customize alignment and use Arrow export, with meaningful cross-user exposure requiring a multi-user context where one user's exported buffer can reach another user; default Pillow configurations are not affected. No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor released Pillow 13.0.0 as the fix.
Regular-expression denial of service in Pillow before 13.0.0 lets unauthenticated remote attackers stall an image-processing worker by submitting a tiny crafted XBM file that triggers catastrophic backtracking in the XBM header parser before image dimensions are ever validated. Any service that routes untrusted uploads through Image.open() with XBM parsing reachable is affected; impact is confined to availability degradation of the decoding worker, with no code execution, data exposure, or integrity impact. The flaw is fixed in Pillow 13.0.0, which replaces the backtracking regex with line-based parsing; no public exploit tooling or confirmed active exploitation was identified at time of analysis, though the upstream fix commit includes a regression test that reproduces a minimal triggering input.
Uninitialized stack memory disclosure in Pillow 9.1.0 through 12.x allows an attacker who controls a palette image passed to Image.quantize(palette=p) to receive raw stack contents - including pointer addresses and stack-canary bytes - embedded as pixel indices in the returned PNG or GIF. Exploitation is not implicit in normal Pillow use: the application must expose the quantize-with-palette path to untrusted input and must accept an attacker-supplied palette whose palette data is empty (p.palette.palette == b""), which causes ImagingPaletteCacheUpdate() to leave its local cache array uninitialized before those bytes are emitted by the topalette() conversion path. The flaw yields confidentiality-only impact with no memory corruption or crash; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the vendor-released fix is Pillow 13.0.0.
Saving attacker-controlled images as GIF in Python Pillow 9.2.0 through 12.x can drive quadratic comment-header assembly and consume excessive CPU, delaying or denying service. The issue is reachable without authentication or user interaction (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N), but only when an application preserves a very large embedded GIF comment and re-encodes the image as GIF; impact is limited to availability. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and the vendor-released fix is Pillow 13.0.0.
Denial of service in Pillow 5.4.0 through pre-13.0.0 allows unauthenticated remote attackers to exhaust CPU by supplying a crafted GIF containing numerous comment extensions; Image.open() parses frame zero and triggers quadratic bytes copying in GifImageFile._seek() before the application can inspect the image. Impact is limited to availability (vendor CVSS 4.0 score 6.9; assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), with no code execution or data exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and environments that only open trusted images are not practically exposed.
Heap use-after-free in Pillow 11.3.0 through 12.x can crash any Python process that encodes TIFF data into an in-memory buffer while an attacker influences the TIFF tags being written. When an application saves to BytesIO with a tiffinfo dictionary containing a tag libtiff rejects during encoding - the documented trigger is a floating-point predictor (PREDICTOR=3) applied to integer sample data - TIFFWriteScanline fails inside ImagingLibTiffEncode, the error path frees the output buffer without closing the TIFF handle, and a later cleanup flushes buffered bytes through the write callback into freed memory. The vector (CVSS 5.9, AV:N/AC:H/PR:N/UI:N, C:N/I:N/A:H) reflects unauthenticated but configuration-dependent reachability: exploitation needs the memory-buffer code path plus attacker-controlled tag values, and the reliable outcome is process termination, with code execution unproven; no public exploit identified at time of analysis, and the upstream fix commit ships a regression test rather than weaponized tooling.
Heap out-of-bounds read in Pillow's tiled-TIFF decoder (versions 8.2.0 through 12.x) lets a crafted TIFF file cause the stride-and-copy loop in _decodeTile to walk past the buffer libtiff allocated, potentially exposing adjacent heap contents in the returned pixel data or crashing the process. Any application that opens untrusted TIFF images with an affected Pillow build is exposed without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, 6.5), though impact is bounded to partial confidentiality loss and partial availability loss with no write primitive. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fix in 13.0.0 makes the decoder reject the triggering images with 'decoder error -2'.
Out-of-bounds heap read in Pillow prior to 13.0.0 lets unauthenticated remote attackers disclose up to three adjacent heap bytes or crash the process, but only when the application explicitly decodes attacker-controlled data using the uncommon planar palette raw modes P;2L or P;4L. This is a genuine but moderate-severity CWE-126 memory-safety defect rather than a top-tier priority: these raw modes are not reached by ordinary image-file opening or auto-detection, and impact is bounded to limited information disclosure or denial of service with no code execution or integrity loss. No public exploit identified at time of analysis; the provided intelligence contains no KEV listing and no POC reference.
Unbounded recursion in Pillow's PDF parser (versions 5.1.0 through 12.x) can crash a Python worker when an application opens an attacker-supplied PDF for append, producing availability-only denial of service. The issue is reachable only when the application explicitly uses Pillow's PDF append mode on untrusted input; the independent assessment rates it as a modest-priority availability issue, not a top-tier emergency, and no public exploit has been identified at time of analysis. Pillow 13.0.0 fixes the problem by capping parser nesting depth.
Command injection in Pillow's WindowsViewer component (all versions prior to 12.3.0) allows arbitrary cmd.exe command execution when a user opens an image with a crafted filename containing shell metacharacters. The root cause is in WindowsViewer.get_command(), which embeds an unsanitized file path directly into an f-string and passes the result to subprocess.Popen with shell=True on Windows. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.