Vulnerabilities

TI-2026-79011 CVE-2026-114501 · GHSA-654x-cwwv-5j9c

Pillow Arrow export leaks stale heap memory when alignment is set

HIGH 67

Pillow is a Python imaging library.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0037 Published 2026-10-21 Partial fix · 13.0.0 CWE-226

TI-2026-79004 CVE-2026-96639 · GHSA-v9pv-5gc8-w2m6

Pillow multi-frame loaders reuse stale native image storage

MEDIUM 50

Pillow is a Python imaging library.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00659 Published 2026-10-21 Partial fix · 13.0.0 CWE-125

TI-2026-79002 CVE-2026-96636 · GHSA-p8hx-v2p6-rp84

Pillow decompression-bomb check bypassed by multi-frame seek()

MEDIUM 62

Pillow is a Python imaging library.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00345 Published 2026-10-21 Partial fix · 13.0.0 CWE-400

TI-2026-79005 CVE-2026-96640 · GHSA-mrfp-p49p-3hf2

Resource exhaustion in Pillow PDF append via malformed page tree

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00604 Published 2026-10-21 Partial fix · 13.0.0 CWE-400

TI-2026-79003 CVE-2026-96637 · GHSA-g842-9rc4-69pw

Decompression bomb check bypass in Pillow allows memory exhaustion

LOW 37

Pillow is a Python imaging library.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00373 Published 2026-10-21 Partial fix · 13.0.0 CWE-400

TI-2026-78998 CVE-2026-96778 · GHSA-g7cr-3p24-7wf7

Heap buffer overflow in Pillow JPEG encoder when writing comments

LOW 36

Pillow is a Python imaging library.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00454 Published 2026-10-21 Partial fix · 13.0.0 CWE-787

TI-2026-78996 CVE-2026-96643 · GHSA-g4qv-2jxx-769h

Pillow PNG eXIf chunk makes EXIF parsing run in quadratic time

LOW 37

Pillow is a Python imaging library.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00373 Published 2026-10-21 Partial fix · 13.0.0 CWE-407

TI-2026-78997 CVE-2026-96644 · GHSA-9v9v-9qvf-h2hj

Heap over-read in Pillow WMF and EMF rendering on Windows

MEDIUM 64

Pillow is a Python imaging library.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00384 Published 2026-10-21 Partial fix · 13.0.0 CWE-125

TI-2026-78992 CVE-2026-96641 · GHSA-4rm8-3hmm-39fg

Integer overflow in Pillow font width calculation

MEDIUM 62

Pillow is a Python imaging library.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00345 Published 2026-10-21 Partial fix · 13.0.0 CWE-190

TI-2026-78993 CVE-2026-96642 · GHSA-3j72-p6qg-6xp7

Infinite CPU loop in Pillow TarIO with negative member size

MEDIUM 64

Pillow is a Python imaging library.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00345 Published 2026-10-21 Partial fix · 13.0.0 CWE-835

TI-2026-78991 CVE-2026-96638 · GHSA-24rc-8hj2-v98c

Memory exhaustion in Pillow BMP RLE decoder enables denial of service

LOW 29

Pillow is a Python imaging library.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00345 Published 2026-10-21 Partial fix · 13.0.0 CWE-400

TI-2026-76631 CVE-2026-112901 · GHSA-xgh8-jp6q-p5x8

Regular expression denial of service in Pillow XBM image parser

LOW 37

Pillow is a Python imaging library.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00532 Published 2026-10-19 Partial fix · 13.0.0 CWE-1333

TI-2026-76630 CVE-2026-112900 · GHSA-w889-685w-c8fh

Argument injection in Pillow Ghostscript call can run commands

MEDIUM 50

Pillow is a Python imaging library.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.01303 Published 2026-10-19 Partial fix · 13.0.0 CWE-78

TI-2026-76629 CVE-2026-112898 · GHSA-rfgq-q3w2-pmv2

Information disclosure in Pillow Image.quantize() via empty palette

HIGH 70

Pillow is a Python imaging library.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00339 Published 2026-10-19 Partial fix · 13.0.0 CWE-457

TI-2026-76628 CVE-2026-112897 · GHSA-q45j-58j2-45rg

Pillow returns uninitialized memory as TIFF pixels

HIGH 71

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00479 Published 2026-10-19 Partial fix · 13.0.0 CWE-908

TI-2026-76627 CVE-2026-112896 · GHSA-pchr-8j38-3x4p

Out-of-bounds read in Pillow TIFF encoder ColorMap handling

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00475 Published 2026-10-19 Partial fix · 13.0.0 CWE-125

TI-2026-76626 CVE-2026-112895 · GHSA-p4wg-p73j-c528

Uncontrolled recursion in Pillow PDF parser causes denial of service

MEDIUM 44

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00594 Published 2026-10-19 Partial fix · 13.0.0 CWE-674

TI-2026-76625 CVE-2026-112894 · GHSA-jg86-v3jv-hrpm

Quadratic-time denial of service in Pillow PDF save_all

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00594 Published 2026-10-19 Partial fix · 13.0.0 CWE-407

TI-2026-76624 CVE-2026-112893 · GHSA-j4m9-6w36-pw47

Invalid free in Pillow FreeType rendering when a stroker is active

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00549 Published 2026-10-19 Partial fix · 13.0.0 CWE-457

TI-2026-76623 CVE-2026-112892 · GHSA-gg2r-wvfm-q9rx

Unbounded memory expansion in Pillow MSP RLE decoder

LOW 38

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00503 Published 2026-10-19 Partial fix · 13.0.0 CWE-409

TI-2026-76622 CVE-2026-112891 · GHSA-fc9g-5qg7-mf45

Quadratic GIF comment copying in Pillow slows GIF saving

LOW 37

Pillow is a Python imaging library.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00549 Published 2026-10-19 Partial fix · 13.0.0 CWE-407

TI-2026-76606 CVE-2026-112406 · GHSA-f2g6-542v-9j58

Infinite loop in Pillow PdfParser.rewrite_pages on cyclic page tree

MEDIUM 44

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00573 Published 2026-10-19 Partial fix · 13.0.0 CWE-835

TI-2026-76605 CVE-2026-112405 · GHSA-cp9v-662q-vvx9

NULL pointer dereference in Pillow's Image.merge function

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00594 Published 2026-10-19 Partial fix · 13.0.0 CWE-476

TI-2026-76604 CVE-2026-112404 · GHSA-c6hw-5grf-ff96

Out-of-bounds read in Pillow TIFF decoding leaks heap memory

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00444 Published 2026-10-19 Partial fix · 13.0.0 CWE-126

TI-2026-76603 CVE-2026-112403 · GHSA-8g5g-8vmr-9782

Heap buffer overflow in Pillow JPEG decoder

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00945 Published 2026-10-19 Partial fix · 13.0.0 CWE-122

Vulnerabilities

Filters