Python Pillow vulnerabilities

CVE-2026-112394 [HIGH] CWE-126 CVE-2026-112394: Pillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can read pa Pillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can read past the end of an input buffer. ImagingRawDecode calculates a packed-pixel row size, while the unpackers read separately padded bit planes. A caller can supply a buffer and image dimensions whose accepted size is smaller than the unpacker's actual foot

CVE-2021-25289 [CRITICAL] CVE-2021-25289: An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when dec An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.

CVE-2026-112406 [MEDIUM] CWE-835 Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle ``` Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle Location: src/PIL/PdfParser.py:505 in PdfParser.rewrite_pages() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ``` A PDF file of a few hundred bytes makes Pillow hang forever, holding one processor core at 100%, when an application tries to a

CVE-2026-112896 [HIGH] CWE-125 Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read ## Summary A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 (ColorMap) with **768 SHORT valu

CVE-2026-112892 [HIGH] CWE-409 Pillow: MSP RLE decoder expands a tiny file into unbounded memory Pillow: MSP RLE decoder expands a tiny file into unbounded memory ### Summary The MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels. ### Details The MSP decoder writes each run into an unbounded `io.BytesIO

CVE-2026-112405 [HIGH] CWE-476 Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0 Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0 ### Summary `Image.merge()` checks the mode of every input band except band 0. If band 0 is a single-band `I` or `F` image, the native merge routine reads a pixel pointer that is NULL for those modes and the process crashes. The IPTC plugin reaches this from a plain `Image.open()` followed by a load, and IPTC has no ma

CVE-2026-112402 [HIGH] CWE-416 Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform ``` Double free in ImagingScaleAffine on calloc failure via Image.transform Location: src/libImaging/Geometry.c:866 in ImagingScaleAffine() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ``` There is a double free in Pillow's `Image.transform()` that crashes the process when an oversized transform runs o

CVE-2026-112897 [HIGH] CWE-908 Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips ``` TiffDecode returns uninitialized memory as pixels for short JPEG strips Location: src/libImaging/TiffDecode.c:554 in _decodeStrip() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ``` Pillow hands back leftover process memory as image pixels when it opens a small crafted TIFF file. Anyone who can get

CVE-2026-112400 [HIGH] CWE-400 Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS ``` GIF seek keeps rejected size after DecompressionBombError, allowing DoS Location: src/PIL/GifImagePlugin.py:293 in GifImageFile._seek() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ``` A GIF of about 60 bytes can make Pillow allocate gigabytes of memory. This affects applications that catch the "im

CVE-2020-35654 [HIGH] CWE-787 CVE-2020-35654: In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr file In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.

CVE-2026-112395 [HIGH] CWE-122 CVE-2026-112395: Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read pa Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-copy loop walks beyond that allocation. An attacker can

CVE-2021-25287 [CRITICAL] CWE-125 CVE-2021-25287: An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.

CVE-2026-112396 [HIGH] CWE-416 CVE-2026-112396: Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in ImagingLibTiffEncode; the error path then frees the output buffer wit

CVE-2026-112399 [HIGH] CWE-789 Pillow: APNG background disposal allocates full canvas before decompression bomb check Pillow: APNG background disposal allocates full canvas before decompression bomb check ``` APNG background disposal allocates full canvas before decompression bomb check Location: src/PIL/PngImagePlugin.py:1000 in PngImageFile._seek() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ``` A 126-byte animated PNG file makes Pillow's `Image.open()` allocate and fill memory sized by

CVE-2026-59197 [HIGH] CWE-190 CVE-2026-59197: Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a n Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked sign

CVE-2026-25990 [HIGH] CWE-787 CVE-2026-25990: Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be trig Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

CVE-2021-25288 [CRITICAL] CWE-125 CVE-2021-25288: An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.

CVE-2026-59198 [HIGH] CWE-125 CVE-2026-59198: Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0.

CVE-2026-96778 [HIGH] CWE-787 Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer ``` Heap buffer overflow writing JPEG comment after ICC profile fills buffer Location: src/libImaging/JpegEncode.c:330 in ImagingJpegEncode() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ``` A heap buffer overflow in Pillow's JPEG encoder lets anyone who can supply an image write up to 64 KB of bytes

CVE-2026-40192 [HIGH] CWE-400 CVE-2026-40192: Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP- Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If