Every CVE Search/ Get API key

CVE-2016-2533

Pillow buffer overflow in ImagingPcdDecode

6.5 MediumFix available

CVE-2016-2533 is a medium vulnerability (CVSS 6.5) in Python Pillow, published February 21, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.03%, the 90th percentile. Fixed in pillow 3.1.1.

Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

4.03%Up 2.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.5

Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.

Record
CVE-2016-2533
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.

Record
CVE-2016-2533
Updated
2026-11-02
EUVDEUVD-2016-0020 No score

Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.

Record
EUVD-2016-0020
Updated
2026-11-03
GitHub AdvisoriesGHSA-3c5c-7235-994j 7.1

Pillow buffer overflow in ImagingPcdDecode

Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.

Record
GHSA-3c5c-7235-994j
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-119
Updated
2026-11-02
OSV 6.5

Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.

Record
CVE-2016-2533
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2016-2533 6.5

Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.

Record
DEBIAN-CVE-2016-2533
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-3c5c-7235-994j 7.1

Pillow buffer overflow in ImagingPcdDecode

Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.

Record
GHSA-3c5c-7235-994j
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-119
Updated
2026-11-02
OSVUBUNTU-CVE-2016-2533 6.5

Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.

Record
UBUNTU-CVE-2016-2533
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVPYSEC-2016-19 No score

Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.

Record
PYSEC-2016-19
Updated
2026-11-02
OSVSUSE-SU-2019:2334-1 No score

Security update for python-Pillow

This update for python-Pillow fixes the following issues:

  • CVE-2016-2533: Fixed a buffer overflow in the PCD decoding (bsc#967970).
  • CVE-2016-4009: Fixed an interger overflow in ImagingResampleHorizontal() (bsc#975500).
Record
SUSE-SU-2019:2334-1
Updated
2026-11-02
OSVSUSE-SU-2020:1194-1 No score

Security update for python-Pillow

This update for python-Pillow fixes the following issues:

Security issues fixed:

  • CVE-2016-2533: Fixed an integer overflow in the ImagingResampleHorizontal function (bsc#967970).
  • CVE-2016-4009: Fixed a buffer overflow in the PCD decoder (bsc#975500).
Record
SUSE-SU-2020:1194-1
Updated
2026-11-02
OSVUSN-3090-1 No score

Pillow vulnerabilities

It was discovered that a flaw in processing a compressed text chunk in a PNG image could cause the image to have a large size when decompressed, potentially leading to a denial of service. (CVE-2014-9601)

Andrew Drake discovered that Pillow incorrectly validated input. A remote attacker could use this to cause Pillow to crash, resulting in a denial of service. (CVE-2014-3589)

Eric Soroos discovered that Pillow incorrectly handled certain malformed FLI, Tiff, and PhotoCD files. A remote attacker could use this issue to cause Pillow to crash, resulting in a denial of service. (CVE-2016-0740, CVE-2016-0775, CVE-2016-2533)

Record
USN-3090-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pillow
PyPI
 before 3.1.1
3.1.1
pillow
Debian:12
 before 3.1.1-1
3.1.1-1
pillow
Debian:13
 before 3.1.1-1
3.1.1-1
pillow
Debian:14
 before 3.1.1-1
3.1.1-1
python-imaging
Debian:6.0
 before 1.1.7-2+deb6u2, plus listed versions
1.1.7-2
1.1.7-2+deb6u2
pillow
Debian:8
 before 2.6.1-2+deb8u2, plus listed versions
2.6.1-22.6.1-2+deb8u1
2.6.1-2+deb8u2
pillow
PyPI
 before 3.1.1, plus listed versions
1.01.11.21.31.4
Show 36 moreShow less
1.51.61.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.7.82.0.02.1.02.2.02.2.12.2.22.3.02.3.12.3.22.4.02.5.02.5.12.5.22.5.32.6.02.6.12.6.22.7.02.8.02.8.12.8.22.9.03.0.03.1.03.1.0.rc13.1.0rc1
3.1.1
python-Pillow
SUSE:OpenStack Cloud 7
 before 2.8.1-4.9.1
2.8.1-4.9.1
python-Pillow
SUSE:Enterprise Storage 4
 before 2.8.1-4.9.1
2.8.1-4.9.1
python-Pillow
SUSE:Enterprise Storage 5
 before 2.8.1-3.6.1
2.8.1-3.6.1
pillow
Ubuntu:14.04:LTS
 before 2.3.0-1ubuntu3.2, plus listed versions
2.2.1-1ubuntu22.2.1-2ubuntu12.2.1-3ubuntu22.2.1-3ubuntu32.2.1-3ubuntu4
Show 4 moreShow less
2.2.1-3ubuntu62.3.0-1ubuntu12.3.0-1ubuntu22.3.0-1ubuntu3
2.3.0-1ubuntu3.2

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open