Vulnerabilities

TI-2026-85664 CVE-2026-112902

Memory disclosure in Pillow libtiff TIFF encoder via crafted tags

LOW 37

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00495 Published 2026-11-05 Partial fix · 13.0.0 CWE-686

TI-2026-85661 CVE-2026-112899

Pillow EPS scale rendering bypasses decompression bomb limit

LOW 29

Pillow is a Python imaging library.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00538 Published 2026-11-05 Partial fix · 13.0.0 CWE-770

TI-2026-85656 CVE-2026-114134

Black GitHub Action installs code from pyproject.toml version field

LOW 38

Black is the uncompromising Python code formatter.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00404 Published 2026-11-05 Fixed in 26.10.1 CWE-829

TI-2026-79011 CVE-2026-114501 · GHSA-654x-cwwv-5j9c

Pillow Arrow export leaks stale heap memory when alignment is set

HIGH 67

Pillow is a Python imaging library.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0037 Published 2026-10-21 Partial fix · 13.0.0 CWE-226

TI-2026-79004 CVE-2026-96639 · GHSA-v9pv-5gc8-w2m6

Pillow multi-frame loaders reuse stale native image storage

MEDIUM 50

Pillow is a Python imaging library.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00659 Published 2026-10-21 Partial fix · 13.0.0 CWE-125

TI-2026-79002 CVE-2026-96636 · GHSA-p8hx-v2p6-rp84

Pillow decompression-bomb check bypassed by multi-frame seek()

MEDIUM 62

Pillow is a Python imaging library.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00345 Published 2026-10-21 Partial fix · 13.0.0 CWE-400

TI-2026-79005 CVE-2026-96640 · GHSA-mrfp-p49p-3hf2

Resource exhaustion in Pillow PDF append via malformed page tree

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00604 Published 2026-10-21 Partial fix · 13.0.0 CWE-400

TI-2026-79003 CVE-2026-96637 · GHSA-g842-9rc4-69pw

Decompression bomb check bypass in Pillow allows memory exhaustion

LOW 37

Pillow is a Python imaging library.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00373 Published 2026-10-21 Partial fix · 13.0.0 CWE-400

TI-2026-78998 CVE-2026-96778 · GHSA-g7cr-3p24-7wf7

Heap buffer overflow in Pillow JPEG encoder when writing comments

LOW 36

Pillow is a Python imaging library.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00454 Published 2026-10-21 Partial fix · 13.0.0 CWE-787

TI-2026-78996 CVE-2026-96643 · GHSA-g4qv-2jxx-769h

Pillow PNG eXIf chunk makes EXIF parsing run in quadratic time

LOW 37

Pillow is a Python imaging library.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00373 Published 2026-10-21 Partial fix · 13.0.0 CWE-407

TI-2026-78997 CVE-2026-96644 · GHSA-9v9v-9qvf-h2hj

Heap over-read in Pillow WMF and EMF rendering on Windows

MEDIUM 64

Pillow is a Python imaging library.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00384 Published 2026-10-21 Partial fix · 13.0.0 CWE-125

TI-2026-78992 CVE-2026-96641 · GHSA-4rm8-3hmm-39fg

Integer overflow in Pillow font width calculation

MEDIUM 62

Pillow is a Python imaging library.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00345 Published 2026-10-21 Partial fix · 13.0.0 CWE-190

TI-2026-78993 CVE-2026-96642 · GHSA-3j72-p6qg-6xp7

Infinite CPU loop in Pillow TarIO with negative member size

MEDIUM 64

Pillow is a Python imaging library.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00345 Published 2026-10-21 Partial fix · 13.0.0 CWE-835

TI-2026-78991 CVE-2026-96638 · GHSA-24rc-8hj2-v98c

Memory exhaustion in Pillow BMP RLE decoder enables denial of service

LOW 29

Pillow is a Python imaging library.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00345 Published 2026-10-21 Partial fix · 13.0.0 CWE-400

TI-2026-76631 CVE-2026-112901 · GHSA-xgh8-jp6q-p5x8

Regular expression denial of service in Pillow XBM image parser

LOW 37

Pillow is a Python imaging library.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00532 Published 2026-10-19 Partial fix · 13.0.0 CWE-1333

TI-2026-76630 CVE-2026-112900 · GHSA-w889-685w-c8fh

Argument injection in Pillow Ghostscript call can run commands

MEDIUM 50

Pillow is a Python imaging library.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.01303 Published 2026-10-19 Partial fix · 13.0.0 CWE-78

TI-2026-76629 CVE-2026-112898 · GHSA-rfgq-q3w2-pmv2

Information disclosure in Pillow Image.quantize() via empty palette

HIGH 70

Pillow is a Python imaging library.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00339 Published 2026-10-19 Partial fix · 13.0.0 CWE-457

TI-2026-76628 CVE-2026-112897 · GHSA-q45j-58j2-45rg

Pillow returns uninitialized memory as TIFF pixels

HIGH 71

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00479 Published 2026-10-19 Partial fix · 13.0.0 CWE-908

TI-2026-76627 CVE-2026-112896 · GHSA-pchr-8j38-3x4p

Out-of-bounds read in Pillow TIFF encoder ColorMap handling

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00475 Published 2026-10-19 Partial fix · 13.0.0 CWE-125

TI-2026-76626 CVE-2026-112895 · GHSA-p4wg-p73j-c528

Uncontrolled recursion in Pillow PDF parser causes denial of service

MEDIUM 44

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00594 Published 2026-10-19 Partial fix · 13.0.0 CWE-674

TI-2026-76625 CVE-2026-112894 · GHSA-jg86-v3jv-hrpm

Quadratic-time denial of service in Pillow PDF save_all

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00594 Published 2026-10-19 Partial fix · 13.0.0 CWE-407

TI-2026-76624 CVE-2026-112893 · GHSA-j4m9-6w36-pw47

Invalid free in Pillow FreeType rendering when a stroker is active

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00549 Published 2026-10-19 Partial fix · 13.0.0 CWE-457

TI-2026-76623 CVE-2026-112892 · GHSA-gg2r-wvfm-q9rx

Unbounded memory expansion in Pillow MSP RLE decoder

LOW 38

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00503 Published 2026-10-19 Partial fix · 13.0.0 CWE-409

TI-2026-76622 CVE-2026-112891 · GHSA-fc9g-5qg7-mf45

Quadratic GIF comment copying in Pillow slows GIF saving

LOW 37

Pillow is a Python imaging library.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00549 Published 2026-10-19 Partial fix · 13.0.0 CWE-407

TI-2026-76606 CVE-2026-112406 · GHSA-f2g6-542v-9j58

Infinite loop in Pillow PdfParser.rewrite_pages on cyclic page tree

MEDIUM 44

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00573 Published 2026-10-19 Partial fix · 13.0.0 CWE-835

Vulnerabilities

Filters