What’s Vulnerable › Products
python-pillow Pillow vulnerabilities
111 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 58 published in the last 12 months.
Check whether your python-pillow Pillow version is affected
Latest python-pillow Pillow vulnerabilities
- CVE-2026-114501 — Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1 (CVSS 5.3)
- CVE-2026-96778 — Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer (CVSS 8.8)
- CVE-2026-96644 — Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds) (CVSS 8.1)
- CVE-2026-96643 — Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time (CVSS 6.5)
- CVE-2026-96642 — Pillow: TarIO negative size field causes infinite CPU-spin loop (CVSS 6.5)
- CVE-2026-96641 — Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise (CVSS 6.5)
- CVE-2026-96640 — Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion (CVSS 7.5)
- CVE-2026-96639 — Pillow multi-frame loaders can reuse stale native image storage after mode transitions (CVSS 9.8)
- CVE-2026-96638 — Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode (CVSS 6.5)
- CVE-2026-96637 — Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS (CVSS 6.5)
- CVE-2026-96636 — Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek) (CVSS 6.5)
- CVE-2026-112901 — Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes (CVSS 7.5)
- CVE-2026-112900 — Pillow: Argument Injection in Ghostscript call, potentially leading into RCE (CVSS 9.8)
- CVE-2026-112898 — Pillow: Image.quantize() with empty palette leaks uninitialized stack memory (CVSS 5.3)
- CVE-2026-112897 — Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips (CVSS 6.2)
- CVE-2026-112896 — Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read (CVSS 7.1)
- CVE-2026-112895 — Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310) (CVSS 7.5)
- CVE-2026-112894 — Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id) (CVSS 7.5)
- CVE-2026-112893 — Pillow: Invalid free in FreeType glyph rendering when a stroker is active (CVSS 7.5)
- CVE-2026-112892 — Pillow: MSP RLE decoder expands a tiny file into unbounded memory (CVSS 7.5)
- CVE-2026-112891 — Pillow: Quadratic GIF comment copying during save (CVSS 7.5)
- CVE-2026-112406 — Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle (CVSS 7.5)
- CVE-2026-112405 — Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0 (CVSS 7.5)
- CVE-2026-112404 — Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels (CVSS 8.2)
- CVE-2026-112403 — Pillow: Heap buffer overflow in ImagingJpegDecode (CVSS 9.8)