Python-pillow Pillow
20 CVEs affecting Python-pillow Pillow. Latest disclosed: 2026-07-14. Critical: 0, High: 13.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-59197 | High | 8.2 | 2026-07-14 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd… |
CVE-2026-42311 | High | 7.8 | 2026-05-09 | Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially… |
CVE-2026-59200 | High | 7.5 | 2026-07-14 | Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the P… |
CVE-2026-59205 | High | 7.5 | 2026-07-14 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption whe… |
CVE-2026-59204 | High | 7.5 | 2026-07-14 | Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000… |
CVE-2026-59199 | High | 7.5 | 2026-07-14 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates n… |
CVE-2026-55380 | High | 7.5 | 2026-07-06 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in sel… |
CVE-2026-55379 | High | 7.5 | 2026-07-06 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker… |
CVE-2026-54060 | High | 7.5 | 2026-07-06 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (… |
CVE-2026-54059 | High | 7.5 | 2026-07-06 | Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them dire… |
CVE-2026-40192 | High | 7.5 | 2026-04-15 | Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making the… |
CVE-2026-25990 | High | 7.5 | 2026-02-11 | Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vuln… |
CVE-2025-48379 | High | 7.1 | 2025-07-01 | Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with d… |
CVE-2026-59198 | Medium | 6.5 | 2026-07-14 | Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE… |
CVE-2026-42310 | Medium | 5.5 | 2026-05-09 | Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefin… |
CVE-2026-42309 | Medium | 5.5 | 2026-05-09 | Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as I… |
CVE-2026-42308 | Medium | 5.5 | 2026-05-09 | Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the cur… |
CVE-2026-59203 | Medium | 5.3 | 2026-07-14 | Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary… |
CVE-2026-55798 | Medium | 4.5 | 2026-07-06 | Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an… |
CVE-2026-54058 | | 2026-07-14 | Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attac… |