Python Pillow vulnerabilities

CVE-2022-45198 [HIGH] CVE-2022-45198: Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).

CVE-2021-27921 [HIGH] CWE-20 CVE-2021-27921: Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the r Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.

CVE-2021-27923 [HIGH] CWE-20 CVE-2021-27923: Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the r Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.

CVE-2021-25290 [HIGH] CWE-787 CVE-2021-25290: An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy w An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.

CVE-2021-25291 [HIGH] CWE-125 CVE-2021-25291: An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in T An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.

CVE-2023-44271 [HIGH] CWE-770 CVE-2023-44271: An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably alloc An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

CVE-2020-10379 [HIGH] CWE-120 CVE-2020-10379: In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c. In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.

CVE-2020-5313 [HIGH] CWE-125 CVE-2020-5313: libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow. libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.

CVE-2022-45199 [HIGH] CWE-400 CVE-2022-45199: Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL. Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.

CVE-2020-35653 [HIGH] CWE-125 CVE-2020-35653: In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because th In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.

CVE-2016-0740 [MEDIUM] CWE-119 CVE-2016-0740: Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1 Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory via a crafted TIFF file.

CVE-2022-22816 [MEDIUM] CWE-125 CVE-2022-22816: path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImageP path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.

CVE-2022-22815 [MEDIUM] CWE-665 CVE-2022-22815: path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.

CVE-2024-28219 [MEDIUM] CWE-680 CVE-2024-28219: In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

CVE-2016-2533 [MEDIUM] CWE-119 CVE-2016-2533: Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Im Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.

CVE-2021-25292 [MEDIUM] CWE-1333 CVE-2021-25292: An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDo An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.

CVE-2020-35655 [MEDIUM] CWE-125 CVE-2020-35655: In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE ima In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.

CVE-2016-0775 [MEDIUM] CWE-119 CVE-2016-0775: Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 al Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.

CVE-2016-3076 [MEDIUM] CWE-119 CVE-2016-3076: Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows rem Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.

CVE-2025-48379 [MEDIUM] CWE-122 CVE-2025-48379: Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer over Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issu