Python-pillow vulnerabilities
60 CVEs and advisories name Python-pillow as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-112902Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
- CVE-2026-112899Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
- CVE-2026-114501Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
- CVE-2026-96639Pillow multi-frame loaders can reuse stale native image storage after mode transitions
- CVE-2026-96636Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
- CVE-2026-96640Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
- CVE-2026-96637Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
- CVE-2026-96778Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
- CVE-2026-96643Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
- CVE-2026-96644Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
- CVE-2026-96641Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
- CVE-2026-96642Pillow: TarIO negative size field causes infinite CPU-spin loop
- CVE-2026-96638Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
- CVE-2026-112901Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
- CVE-2026-112900Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
- CVE-2026-112898Pillow: Image.quantize() with empty palette leaks uninitialized stack memory
- CVE-2026-112897Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
- CVE-2026-112896Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
- CVE-2026-112895Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
- CVE-2026-112894Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
- CVE-2026-112893Pillow: Invalid free in FreeType glyph rendering when a stroker is active
- CVE-2026-112892Pillow: MSP RLE decoder expands a tiny file into unbounded memory
- CVE-2026-112891Pillow: Quadratic GIF comment copying during save
- CVE-2026-112406Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
- CVE-2026-112405Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
- CVE-2026-112404Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
- CVE-2026-112403Pillow: Heap buffer overflow in ImagingJpegDecode
- CVE-2026-112402Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
- CVE-2026-112397Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
- CVE-2026-112392Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images