Python-pillow vulnerabilities
60 CVEs and advisories name Python-pillow as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-112401Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()
- CVE-2026-112400Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
- CVE-2026-112399Pillow: APNG background disposal allocates full canvas before decompression bomb check
- CVE-2026-112398Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
- CVE-2026-112396Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
- CVE-2026-112395Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
- CVE-2026-112394Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
- CVE-2026-112393Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
- CVE-2026-112391Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()
- CVE-2026-112390Pillow: Infinite loop in MIC n_frames when the embedded TIFF
- CVE-2026-54058Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
- CVE-2026-59197Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
- CVE-2026-59200Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
- CVE-2026-59198Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
- CVE-2026-59205Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch
- CVE-2026-59203Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
- CVE-2026-59199Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
- CVE-2026-59204Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
- CVE-2026-55379Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
- CVE-2026-55380Pillow GdImageFile decompression bomb protection bypass
- CVE-2026-54060Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
- CVE-2026-54059Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
- CVE-2026-55798Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path
- CVE-2026-42311Pillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow)
- CVE-2026-42310Pillow: PDF Parsing Trailer Infinite Loop (DoS)
- CVE-2026-42308Pillow: Integer overflow when processing fonts
- CVE-2026-42309Pillow: Heap buffer overflow with nested list coordinates
- CVE-2026-40192Pillow is vulnerable to a FITS GZIP decompression bomb
- CVE-2026-25990Pillow has an out-of-bounds write when loading PSD images
- CVE-2025-48379Pillow Vulnerable to Write Buffer Overflow on BCn encoding