python-pillow

Records319All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical40CVSS 9.0–10.0

CVSS high143CVSS 7.0–8.9

Exploited now

python-pillow records in CISA KEV

No python-pillow vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Python 140 records HIGH Pillow 111 records HIGH Urllib3 22 records MEDIUM Requests 6 records MEDIUM Setuptools 4 records HIGH Keyring 3 records LOW Black 2 records MEDIUM Pyxdg 2 records LOW

Records

111 records in Pillow · all components

TI-2026-76627 CVE-2026-112896 · GHSA-pchr-8j38-3x4p

Out-of-bounds read in Pillow TIFF encoder ColorMap handling

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00475 Published 2026-10-19 Partial fix · 13.0.0 CWE-125

TI-2026-76625 CVE-2026-112894 · GHSA-jg86-v3jv-hrpm

Quadratic-time denial of service in Pillow PDF save_all

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00594 Published 2026-10-19 Partial fix · 13.0.0 CWE-407

TI-2026-76605 CVE-2026-112405 · GHSA-cp9v-662q-vvx9

NULL pointer dereference in Pillow's Image.merge function

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00594 Published 2026-10-19 Partial fix · 13.0.0 CWE-476

TI-2026-76604 CVE-2026-112404 · GHSA-c6hw-5grf-ff96

Out-of-bounds read in Pillow TIFF decoding leaks heap memory

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00444 Published 2026-10-19 Partial fix · 13.0.0 CWE-126

TI-2026-76602 CVE-2026-112402 · GHSA-7mwm-ghpf-9vrm

Double free in Pillow ImagingScaleAffine on allocation failure

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00594 Published 2026-10-19 Partial fix · 13.0.0 CWE-416

TI-2026-76600 CVE-2026-112400 · GHSA-65qm-jvmh-6pqg

GIF seek in Pillow keeps rejected size, allowing denial of service

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00594 Published 2026-10-19 Partial fix · 13.0.0 CWE-400

TI-2026-76599 CVE-2026-112399 · GHSA-5xm2-6676-qcp9

Excessive memory use in Pillow APNG handling enables denial of service

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00529 Published 2026-10-19 Partial fix · 13.0.0 CWE-789

TI-2026-76597 CVE-2026-112397 · GHSA-58r4-6rv3-gfh8

Out-of-bounds memory access in Pillow morphology on zero-width images

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00573 Published 2026-10-19 Partial fix · 13.0.0 CWE-787

TI-2026-42349 CVE-2026-59204 · GHSA-vjc4-5qp5-m44j

Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00385 Published 2026-07-14 Partial fix · 12.3.0 CWE-789

TI-2026-79005 CVE-2026-96640 · GHSA-mrfp-p49p-3hf2

Resource exhaustion in Pillow PDF append via malformed page tree

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00604 Published 2026-10-21 Partial fix · 13.0.0 CWE-400

TI-2026-76624 CVE-2026-112893 · GHSA-j4m9-6w36-pw47

Invalid free in Pillow FreeType rendering when a stroker is active

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00549 Published 2026-10-19 Partial fix · 13.0.0 CWE-457

TI-2026-76603 CVE-2026-112403 · GHSA-8g5g-8vmr-9782

Heap buffer overflow in Pillow JPEG decoder

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00945 Published 2026-10-19 Partial fix · 13.0.0 CWE-122

TI-2026-76598 CVE-2026-112398 · GHSA-5x8w-8jj5-q52h

Heap buffer overflow in Pillow FlashPix JPEG decoding

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00696 Published 2026-10-19 Partial fix · 13.0.0 CWE-122

TI-2026-76595 CVE-2026-112395 · GHSA-462x-pgg6-55fp

Pillow tiled-TIFF decoder reads past tile buffer

HIGH 75

Pillow is a Python imaging library.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00514 Published 2026-10-19 Partial fix · 13.0.0 CWE-122

TI-2026-76593 CVE-2026-112393 · GHSA-332p-7hrc-92wf

Pillow heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.01019 Published 2026-10-19 Partial fix · 13.0.0 CWE-122

TI-2026-76592 CVE-2026-112392 · GHSA-27h8-gf7j-v5hc

NULL dereference in Pillow rank filters crashes on zero-size images

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00593 Published 2026-10-19 Partial fix · 13.0.0 CWE-476

TI-2026-76590 CVE-2026-112390 · GHSA-22hg-r758-rrw9

Infinite loop in Pillow MIC frame counting with embedded TIFF

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00593 Published 2026-10-19 Partial fix · 13.0.0 CWE-835

TI-2026-42344 CVE-2026-59197 · GHSA-xj96-63gp-2gmr

Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

HIGH 75

Pillow is a Python imaging library.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00445 Published 2026-07-14 Partial fix · 12.3.0 CWE-190

TI-2026-42350 CVE-2026-59205 · GHSA-9hw9-ch79-4vh6

Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch

HIGH 72

Pillow is a Python imaging library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00385 Published 2026-07-14 Partial fix · 12.3.0 CWE-787

TI-2026-42348 CVE-2026-59203 · GHSA-pg7v-jwj7-p798

Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service

HIGH 72

Pillow is a Python imaging library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00399 Published 2026-07-14 Partial fix · 12.3.0 CWE-835

TI-2026-42347 CVE-2026-59200 · GHSA-jjj6-mw9f-p565

Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

HIGH 72

Pillow is a Python imaging library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00385 Published 2026-07-14 Partial fix · 12.3.0 CWE-400

TI-2026-42346 CVE-2026-59199 · GHSA-6r8x-57c9-28j4

Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

HIGH 72

Pillow is a Python imaging library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00385 Published 2026-07-14 Partial fix · 12.3.0 CWE-190

TI-2026-39958 CVE-2026-55380 · GHSA-phj9-mv4w-65pm

Pillow GdImageFile decompression bomb protection bypass

HIGH 72

Pillow is a Python imaging library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00518 Published 2026-07-06 Partial fix · 12.3.0 CWE-789

TI-2026-39957 CVE-2026-55379 · GHSA-45hq-cxwh-f6vc

Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb…

HIGH 72

Pillow is a Python imaging library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00522 Published 2026-07-06 Partial fix · 12.3.0 CWE-789

TI-2026-38994 CVE-2026-54060 · GHSA-5x94-69rx-g8h2

Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

HIGH 72

Pillow is a Python imaging library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00418 Published 2026-07-06 Partial fix · 12.3.0 CWE-789

Open these records in search →