Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Medium | 6.3 | CVE-2026-114501 |
Pillow is a Python imaging library
python-pillow, Pillowpython-pillow Pillow, Pillow
|
NVD | |||
|
CVE-2026-114501Pillow is a Python imaging library
Executive summaryThis advisory is a code diff from the Pillow Python imaging library that changes how images are exported as Arrow arrays. The advisory does not describe a security impact, severity rating, or exploitation, and it does not state a CVSS score. The advisory does not state a vendor recommendation beyond the code and documentation changes shown. Technical summaryThe diff changes the Arrow export path in libImaging and _imaging.c so that images with non-contiguous rows raise a ValueError instead of returning incorrect data or crashing; the release notes say empty images, frombuffer images with row stride or bottom-up rows, and memory-mapped uncompressed files were previously affected. The advisory does not state a vulnerability class, attack vector, or preconditions for exploitation. It does not state affected versions or fixed versions, although the release notes reference version 13.0.0. It does not state any workaround or detection guidance. The advisory references GHSA identifiers in test comments but does not describe them. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/python-pillow/Pillow/commit/…560be7dea3bf979d2e6a Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.7 | CVE-2026-96778 |
Pillow is a Python imaging library
python-pillow, Pillowpython-pillow Pillow, Pillow
|
NVD | |||
|
CVE-2026-96778Pillow is a Python imaging library
Executive summaryThe advisory describes a fix in the Pillow Python imaging library concerning how JPEG comments and related metadata are written when saving images, which could overflow the encoder buffer. The text provided does not state how serious the issue is, and it does not explicitly state a recommended action beyond the code changes shown. Technical summaryThe advisory appears to be a copy of a Pillow code diff that adds a check for comment length in JpegImagePlugin.py, raising a ValueError when the comment exceeds MAX_BYTES_IN_MARKER, and adds comment size to the encoder buffer sizing. A matching check in src/libImaging/JpegEncode.c skips writing the COM marker when the comment plus five header bytes exceeds the free buffer space. The vulnerability class, CVSS score, attack vector, affected version range, fixed version number, workarounds, and exploitation status are not stated in the text provided. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/python-pillow/Pillow/commit/…b469fecdd02c70854f9b Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.1 | CVE-2026-96644 |
Pillow is a Python imaging library
python-pillow, Pillowpython-pillow Pillow, Pillow
|
NVD | |||
|
CVE-2026-96644Pillow is a Python imaging library
Executive summaryThe advisory describes a fix to the Pillow Python imaging library, where the Windows WMF image loading path could read past the end of a memory buffer when given oversized dimensions. The advisory text provided does not state a severity rating or a CVSS score. The fix adds input checks that reject oversized or negative dimensions and DPI values. Technical summaryThe flaw is a heap buffer over-read in the native drawwmf handler (src/display.c) caused by 16-bit BITMAPCOREHEADER width and height fields being silently truncated while the buffer read still uses the untruncated values. The advisory's test case uses a crafted DPI value that produces a 68450x1 image, which is described as exceeding the 65535 limit. The patch rejects width or height values that are zero, negative, or above 65535 with a ValueError reading invalid dimensions, rejects negative DPI values, and returns a blank RGB image when a dimension is zero. The advisory does not state the affected Pillow versions, the fixed version number, a CVSS score, whether the issue is exploited in the wild, or any workaround. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/python-pillow/Pillow/commit/…8fd7f132ba0d40c428b7 Impact if exploitedConfidentialityLow IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.1 | CVE-2026-96643 |
Pillow is a Python imaging library
python-pillow, Pillowpython-pillow Pillow, Pillow
|
NVD | |||
|
CVE-2026-96643Pillow is a Python imaging library
Executive summaryThe advisory concerns Pillow, a Python imaging library, and a flaw in how it handles repeated EXIF headers in image metadata. The text provided shows only a code diff and does not state how serious the issue is or what the vendor recommends. Technical summaryThe diff changes the EXIF loading routine in src/PIL/Image.py so that repeated "Exif\x00\x00" headers are stripped with a regular expression limited to one or two occurrences, and adds a test for a duplicate-header case that expects a SyntaxError. The vulnerability class, attack vector, and preconditions are not stated. Affected versions are not stated, and fixed versions are not stated. No CVSS score, workaround, exploitation status, or detection guidance is stated in the advisory text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/python-pillow/Pillow/commit/…2f4cd026678acd40fd6c Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.1 | CVE-2026-96642 |
Pillow is a Python imaging library
python-pillow, Pillowpython-pillow Pillow, Pillow
|
NVD | |||
|
CVE-2026-96642Pillow is a Python imaging library
Executive summaryThe advisory is a NIST NVD entry for CVE-2026-96642, which concerns the Pillow Python imaging library. The text provided shows a code change to Pillow's TAR file handling that adds a check for non-positive offsets, but the advisory does not state how severe the issue is. The advisory does not state a vendor recommendation beyond the code change shown. Technical summaryThe change in src/PIL/TarIO.py adds a check that raises a ValueError with the message "offset must be positive" when the computed seek offset from a TAR entry size is not positive, and a new test feeds a crafted TAR header with sizes of -1 and 0. The advisory does not state the vulnerability class, attack vector, or preconditions in its own words, and does not state affected versions, fixed versions, workarounds, CVSS score, or exploitation status. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/python-pillow/Pillow/commit/…e2b1645fc4185edaf71d Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.5 | CVE-2026-96641 |
Pillow is a Python imaging library
python-pillow, Pillowpython-pillow Pillow, Pillow
|
NVD | |||
|
CVE-2026-96641Pillow is a Python imaging library
Executive summaryThe advisory concerns Pillow, a Python imaging library, and a fix for a width calculation overflow in its font handling. The text provided shows only a code diff with no severity rating stated. The advisory does not state a recommended action beyond the code change. Technical summaryThe change adds a check in the textwidth function of src/_imaging.c that raises an OverflowError with the message "Width too small" when a negative glyph dx value would underflow the accumulated width below INT_MIN. The vulnerability class is inferred from the fix as an integer overflow, though the advisory does not name a CWE. The attack vector and preconditions are not stated, but the related test feeds a crafted PIL font file with large positive or negative dx values. Affected versions are not stated, and no fixed version number is stated. No workaround is stated. No detection guidance is stated. No CVSS score or exploitation status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/python-pillow/Pillow/commit/…4d8491eb80cd12b760a4 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.2 | CVE-2026-96640 |
Pillow is a Python imaging library
python-pillow, Pillowpython-pillow Pillow, Pillow
|
NVD | |||
|
CVE-2026-96640Pillow is a Python imaging library
Executive summaryThe advisory describes a flaw in Pillow, a Python imaging library, in how it handles PDF page trees. The text shows a code change that adds checks for cyclic or duplicate references in the PDF page tree. The advisory text provided does not state how severe the issue is or what version users should upgrade to. Technical summaryThe fix addresses cyclic or duplicate references in the PDF page tree handled by the PdfParser module, which could cause unbounded or incorrect traversal when linearizing pages. The change adds a processed-ID set to linearize_page_tree and raises a PdfFormatError when a reference repeats. The advisory does not state attack vector or preconditions beyond processing a crafted PDF, nor a CVSS score, affected version range, fixed version number, workaround, or exploitation status. Detection guidance is not stated; the content is a code diff and tests only. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/python-pillow/Pillow/commit/…f8a4b926e6622b702bc7 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Critical | 9.8 | CVE-2026-96639 |
Pillow is a Python imaging library
python-pillow, Pillowpython-pillow Pillow, Pillow
|
NVD | |||
|
CVE-2026-96639Pillow is a Python imaging library
Executive summaryThe advisory describes a fix in Pillow, a Python imaging library, that changes how image frames are handled when switching between frames of different mode or size. The advisory text provided does not state a severity rating, and it does not describe the impact in terms of confidentiality, integrity, or availability. Technical summaryThe material shows code and test changes to Pillow's seek and load logic across DCX, MIC, MPO, PSD, and JPEG plugins, and to the base Image and ImageFile classes, so that the cached internal image is cleared when a frame's mode or size changes. The advisory does not state the vulnerability class, attack vector, or preconditions in words. Affected versions are not stated, and fixed versions are not stated. No workaround, exploitation status, CVSS score, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/python-pillow/Pillow/commit/…e123773d525f40f2522a Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.5 | CVE-2026-96638 |
Pillow is a Python imaging library
python-pillow, Pillowpython-pillow Pillow, Pillow
|
NVD | |||
|
CVE-2026-96638Pillow is a Python imaging library
Executive summaryThe advisory concerns Pillow, a Python imaging library, and a change to how it decodes BMP image data. The text provided does not state how serious the issue is, and it does not describe a clear vulnerability or any recommended fix beyond a code change merged into the main branch. Technical summaryThe advisory text is a copied GitHub pull request conversation with no CVE description, vulnerability class, or attack vector stated. It mentions a change to limit decoding of MSP data and BMP-labeled code, titled 'Do not decode more MSP data than necessary' and 'Do not prepare more data than necessary'. Affected versions are not stated, and fixed versions are not stated. Workarounds are not stated, exploitation in the wild is not stated, and no CVSS score is stated. No detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/python-pillow/Pillow/pull/10015 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.1 | CVE-2026-96637 |
Pillow is a Python imaging library
python-pillowpython-pillow Pillow
|
NVD | |||
|
CVE-2026-96637Pillow is a Python imaging library
From the advisoryPillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.5 | CVE-2026-96636 |
Pillow is a Python imaging library
python-pillowpython-pillow Pillow
|
NVD | |||
|
CVE-2026-96636Pillow is a Python imaging library
From the advisoryPillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DCX frames and replace self._size without rerunning Image._decompression_bomb_check(). A crafted multi-frame image can use a tiny first frame to pass Image.open() and then declare an over-limit later frame. Normal frame iteration through seek(), load(), or ImageSequence.Iterator can decode that frame and commit hundreds of megabytes or more, causing memory-exhaustion denial of service. This issue is fixed in version 13.0.0. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.9 | CVE-2026-112901 |
Pillow is a Python imaging library
python-pillowpython-pillow Pillow
|
NVD | |||
|
CVE-2026-112901Pillow is a Python imaging library
From the advisoryPillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile._open, when an application calls Image.open() on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlled header before image dimensions are accepted, stalling a worker for minutes and denying service. This issue is fixed in version 13.0.0. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Critical | 9.2 | CVE-2026-112900 |
Pillow is a Python imaging library
python-pillowpython-pillow Pillow
|
NVD | |||
|
CVE-2026-112900Pillow is a Python imaging library
From the advisoryPillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a hyphen can be interpreted as a Ghostscript option. An attacker who controls the filename can inject Ghostscript arguments. Arbitrary command execution specifically requires a leading @ argument-file filename and control of the referenced text file containing additional Ghostscript arguments; the reported chain reproduces with the default -dSAFER invocation. This issue is fixed in version 13.0.0. Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.9 | CVE-2026-112898 |
Pillow is a Python imaging library
python-pillowpython-pillow Pillow
|
NVD | |||
|
CVE-2026-112898Pillow is a Python imaging library
From the advisoryPillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as output pixel indices. An attacker who controls the palette image can obtain stack contents from a returned PNG or GIF. This can disclose addresses and stack-canary data without an out-of-bounds access, memory corruption, or process crash. This issue is fixed in version 13.0.0. Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.7 | CVE-2026-112897 |
Pillow is a Python imaging library
python-pillowpython-pillow Pillow
|
NVD | |||
|
CVE-2026-112897Pillow is a Python imaging library
From the advisoryPillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the bytes written by libtiff, but Pillow converts the expected rows without clearing the unwritten tail. The tile path is affected from 5.3.0 and the strip path from 6.0.0. An attacker can supply a crafted TIFF to an application that loads and returns or re-encodes its pixels. This can disclose stale heap contents without memory corruption or a process crash. This issue is fixed in version 13.0.0. Impact if exploitedConfidentialityHigh IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.8 | CVE-2026-112896 |
Pillow is a Python imaging library
python-pillowpython-pillow Pillow
|
NVD | |||
|
CVE-2026-112896Pillow is a Python imaging library
From the advisoryPillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read. This can disclose heap memory in the output or crash the process. This issue is fixed in version 13.0.0. Impact if exploitedConfidentialityLow IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.7 | CVE-2026-112895 |
Pillow is a Python imaging library
python-pillowpython-pillow Pillow
|
NVD | |||
|
CVE-2026-112895Pillow is a Python imaging library
From the advisoryPillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact repeated-offset guard, so deep or cyclic page trees and long chains of unique trailer offsets can exhaust the Python stack. Repeated non-cyclic /Kids references can also cause super-linear CPU and memory use. An attacker can supply such a PDF to an application that calls Image.save with PDF append enabled. This can raise an uncaught RecursionError or consume excessive CPU and memory before output is written, causing denial of service. This issue is fixed in version 13.0.0. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.7 | CVE-2026-112894 |
Pillow is a Python imaging library
python-pillowpython-pillow Pillow
|
NVD | |||
|
CVE-2026-112894Pillow is a Python imaging library
From the advisoryPillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF. This can consume excessive CPU and deny service. This issue is fixed in version 13.0.0. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.2 | CVE-2026-112893 |
Pillow is a Python imaging library
python-pillowpython-pillow Pillow
|
NVD | |||
|
CVE-2026-112893Pillow is a Python imaging library
From the advisoryPillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.7 | CVE-2026-112892 |
Pillow is a Python imaging library
python-pillowpython-pillow Pillow
|
NVD | |||
|
CVE-2026-112892Pillow is a Python imaging library
From the advisoryPillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels. This can exhaust memory and deny service even when the declared pixel count passes the decompression-bomb check. This issue is fixed in version 13.0.0. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.9 | CVE-2026-112891 |
Pillow is a Python imaging library
python-pillowpython-pillow Pillow
|
NVD | |||
|
CVE-2026-112891Pillow is a Python imaging library
From the advisoryPillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. _get_global_header() repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attacker can supply an image with a large GIF comment to an application that saves it as GIF. This can consume excessive CPU and delay or deny service. This issue is fixed in version 13.0.0. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.7 | CVE-2026-112406 |
Pillow is a Python imaging library
python-pillowpython-pillow Pillow
|
NVD | |||
|
CVE-2026-112406Pillow is a Python imaging library
From the advisoryPillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to that PDF. This can hold the worker at full CPU and deny service. This issue is fixed in version 13.0.0. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.7 | CVE-2026-112405 |
Pillow is a Python imaging library
python-pillowpython-pillow Pillow
|
NVD | |||
|
CVE-2026-112405Pillow is a Python imaging library
From the advisoryPillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC file can reach this path when an application opens and loads it, or a caller can invoke Image.merge() directly with such a first band. This causes a native process crash. This issue is fixed in version 13.0.0. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.8 | CVE-2026-112404 |
Pillow is a Python imaging library
python-pillowpython-pillow Pillow
|
NVD | |||
|
CVE-2026-112404Pillow is a Python imaging library
From the advisoryPillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not verify that the required input row fits inside the row libtiff produced, while the strip path has this validation. Loading pixels from such a crafted TIFF can expose adjacent heap data in output pixels or crash the process. This issue is fixed in version 13.0.0. Impact if exploitedConfidentialityLow IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Critical | 9.2 | CVE-2026-112403 |
Pillow is a Python imaging library
python-pillowpython-pillow Pillow
|
NVD | |||
|
CVE-2026-112403Pillow is a Python imaging library
From the advisoryPillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can ignore the requested downscaling geometry. An attacker can supply such a JPEG to an application that uses draft() or thumbnail() to request downscaling. This can corrupt heap memory, crash the process, or potentially allow code execution. Older libjpeg-turbo 2.x and IJG builds reject the SOF3 input. This issue is fixed in version 13.0.0. Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||