Vulnerabilities in python-pillow
60 resultsCVE-2026-59199HIGHPillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflowEPSS 0.4%CVE-2026-59204HIGHPillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of serviceEPSS 0.4%CVE-2026-59205HIGHPillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatchEPSS 0.4%CVE-2026-59200HIGHPillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()EPSS 0.4%CVE-2026-96644HIGHPillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)EPSS 0.4%CVE-2026-96637HIGHPillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoSEPSS 0.4%CVE-2026-96643HIGHPillow: PNG eXIf chunk makes EXIF parsing run in quadratic timeEPSS 0.4%CVE-2026-114501MEDIUMPillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1EPSS 0.4%CVE-2026-96641MEDIUMPillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromiseEPSS 0.3%CVE-2026-96642HIGHPillow: TarIO negative size field causes infinite CPU-spin loopEPSS 0.3%CVE-2026-96636MEDIUMPillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)EPSS 0.3%CVE-2026-96638MEDIUMPillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute modeEPSS 0.3%CVE-2026-112898MEDIUMPillow: Image.quantize() with empty palette leaks uninitialized stack memoryEPSS 0.3%CVE-2025-48379HIGHPillow Vulnerable to Write Buffer Overflow on BCn encodingEPSS 0.3%CVE-2026-59198MEDIUMPillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated imagesEPSS 0.3%CVE-2026-55798MEDIUMPillow: WindowsViewer.get_command() OS command injection via unescaped shell pathEPSS 0.2%CVE-2026-42310MEDIUMPillow: PDF Parsing Trailer Infinite Loop (DoS)EPSS 0.2%CVE-2026-42311HIGHPillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow)EPSS 0.1%CVE-2026-42309MEDIUMPillow: Heap buffer overflow with nested list coordinatesEPSS 0.1%CVE-2026-42308MEDIUMPillow: Integer overflow when processing fontsEPSS 0.1%