CVE-2016-4009
Pillow Integer overflow in ImagingResampleHorizontal
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.
- Record
CVE-2016-4009- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.
- Record
CVE-2016-4009- Updated
- 2026-11-02
EUVDEUVD-2016-0023 No score
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.
- Record
EUVD-2016-0023- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hvr8-466p-75rh
Pillow Integer overflow in ImagingResampleHorizontal
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.
- Record
GHSA-hvr8-466p-75rh- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.
- Record
CVE-2016-4009- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-4009
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.
- Record
DEBIAN-CVE-2016-4009- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-hvr8-466p-75rh
Pillow Integer overflow in ImagingResampleHorizontal
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.
- Record
GHSA-hvr8-466p-75rh- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-4009
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.
- Record
UBUNTU-CVE-2016-4009- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVPYSEC-2016-7 No score
Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.
- Record
PYSEC-2016-7- Updated
- 2026-11-02
OSVSUSE-SU-2019:2334-1 No score
Security update for python-Pillow
This update for python-Pillow fixes the following issues:
- CVE-2016-2533: Fixed a buffer overflow in the PCD decoding (bsc#967970).
- CVE-2016-4009: Fixed an interger overflow in ImagingResampleHorizontal() (bsc#975500).
- Record
SUSE-SU-2019:2334-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:1194-1 No score
Security update for python-Pillow
This update for python-Pillow fixes the following issues:
Security issues fixed:
- CVE-2016-2533: Fixed an integer overflow in the ImagingResampleHorizontal function (bsc#967970).
- CVE-2016-4009: Fixed a buffer overflow in the PCD decoder (bsc#975500).
- Record
SUSE-SU-2020:1194-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pillowPyPI |
before 3.1.1 | 3.1.1 |
pillowDebian:12 |
before 3.1.1-1 | 3.1.1-1 |
pillowDebian:13 |
before 3.1.1-1 | 3.1.1-1 |
pillowDebian:14 |
before 3.1.1-1 | 3.1.1-1 |
pillowPyPI |
before 3.1.1, plus listed versions 1.01.11.21.31.4 Show 36 moreShow less1.51.61.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.7.82.0.02.1.02.2.02.2.12.2.22.3.02.3.12.3.22.4.02.5.02.5.12.5.22.5.32.6.02.6.12.6.22.7.02.8.02.8.12.8.22.9.03.0.03.1.03.1.0.rc13.1.0rc1 |
3.1.1 |
python-PillowSUSE:OpenStack Cloud 7 From an advisory covering 2 CVEs |
before 2.8.1-4.9.1 | 2.8.1-4.9.1 |
python-PillowSUSE:Enterprise Storage 4 From an advisory covering 2 CVEs |
before 2.8.1-4.9.1 | 2.8.1-4.9.1 |
python-PillowSUSE:Enterprise Storage 5 From an advisory covering 2 CVEs |
before 2.8.1-3.6.1 | 2.8.1-3.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-4009 is a critical vulnerability (CVSS 9.8) in Python Pillow, published April 13, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.87%, the 94th percentile. Fixed in pillow 3.1.1.
References
security.gentoo.org/glsa/201612-52
github.com/python-pillow/Pillow/pull/1714
securityfocus.com/bid/86064
nvd.nist.gov/vuln/detail/CVE-2016-4009
Show 12 moreShow less
security-tracker.debian.org/tracker/CVE-2016-4009
suse.com/support/update/announcement/2019/suse-su-20192334-1
bugzilla.suse.com/967970
ubuntu.com/security/CVE-2016-4009
cve.org/CVERecord?id=CVE-2016-4009