Vulnerabilidades em python-pillow

60 resultados
Análise Vexday

A biblioteca Python Pillow apresenta um perfil de risco moderado com 20 vulnerabilidades catalogadas, das quais 17 foram publicadas nos últimos 90 dias, indicando descobertas recentes aceleradas. Nenhuma vulnerabilidade está sob ataque ativo (KEV) e não há casos críticos documentados, mas a fraqueza dominante CWE-787 (out-of-bounds write) sugere potencial para exploração com impacto significativo em sistemas que processam imagens não confiáveis. A concentração temporal das divulgações recomenda monitoramento ativo e planejamento de patches prioritários.

CVE-2026-112900CRITICALPillow: Argument Injection in Ghostscript call, potentially leading into RCEEPSS 1.3%CVE-2026-112393CRITICALPillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIOEPSS 1.0%CVE-2026-112403CRITICALPillow: Heap buffer overflow in ImagingJpegDecodeEPSS 0.9%CVE-2026-112398CRITICALPillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code executionEPSS 0.7%CVE-2026-112396MEDIUMPillow: Heap use-after-free when encoding TIFF to an in-memory bufferEPSS 0.7%CVE-2026-40192HIGHPillow is vulnerable to a FITS GZIP decompression bombEPSS 0.7%CVE-2026-96639CRITICALPillow multi-frame loaders can reuse stale native image storage after mode transitionsEPSS 0.7%CVE-2026-112401MEDIUMPillow: Quadratic GIF comment concatenation allows DoS in Image.open()EPSS 0.6%CVE-2026-96640HIGHPillow PDF append accepts malformed shared page-tree DAG causing resource exhaustionEPSS 0.6%CVE-2026-112400HIGHPillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoSEPSS 0.6%CVE-2026-112402HIGHPillow: Double free in ImagingScaleAffine on calloc failure via Image.transformEPSS 0.6%CVE-2026-112894HIGHPillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)EPSS 0.6%CVE-2026-112405HIGHPillow: NULL pointer dereference in Image.merge via an unvalidated band 0EPSS 0.6%CVE-2026-112895HIGHPillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)EPSS 0.6%CVE-2026-112390HIGHPillow: Infinite loop in MIC n_frames when the embedded TIFFEPSS 0.6%CVE-2026-112392HIGHPillow: NULL dereference in ImagingExpand via rank filters on zero-size imagesEPSS 0.6%CVE-2026-112391MEDIUMPillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()EPSS 0.6%CVE-2026-112397HIGHPillow: Out-of-bounds access in _imagingmorph on a zero-width imageEPSS 0.6%CVE-2026-112406HIGHPillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycleEPSS 0.6%CVE-2026-112394MEDIUMPillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer sizeEPSS 0.6%