CVE-2020-10379
Buffer overflow in Pillow
In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
- Record
CVE-2020-10379- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-120
- Updated
- 2026-11-02
CVE List No score
In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
- Record
CVE-2020-10379- Updated
- 2026-11-02
EUVDEUVD-2020-0131 No score
In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
- Record
EUVD-2020-0131- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8843-m7mw-mxqm
Buffer overflow in Pillow
In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
- Record
GHSA-8843-m7mw-mxqm- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSV
In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
- Record
CVE-2020-10379- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-10379
In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
- Record
DEBIAN-CVE-2020-10379- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-8843-m7mw-mxqm
Buffer overflow in Pillow
In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
- Record
GHSA-8843-m7mw-mxqm- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-10379
In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
- Record
UBUNTU-CVE-2020-10379- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-pillow-2020-10379 No score
In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
- Record
BIT-pillow-2020-10379- Updated
- 2026-11-02
OSVPYSEC-2020-78 No score
In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
- Record
PYSEC-2020-78- Updated
- 2026-11-02
OSVUSN-4430-2 No score
pillow vulnerabilities
USN-4430-1 fixed vulnerabilities in Pillow. This update provides the corresponding updates for Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted image file, a remote attacker could possibly cause Pillow to crash, resulting in a denial of service.
- Record
USN-4430-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pillowPyPI |
before 7.1.0 | 7.1.0 |
pillowBitnami |
before 7.1.0 | 7.1.0 |
pillowDebian:12 |
before 7.2.0-1 | 7.2.0-1 |
pillowDebian:13 |
before 7.2.0-1 | 7.2.0-1 |
pillowDebian:14 |
before 7.2.0-1 | 7.2.0-1 |
pillowPyPI |
before 7.1.0, plus listed versions 1.01.11.21.31.4 Show 45 moreShow less1.51.61.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.7.82.0.02.1.02.2.02.2.12.2.22.3.02.3.12.3.22.4.02.5.02.5.12.5.22.5.32.6.02.6.12.6.22.7.02.8.02.8.12.8.22.9.03.0.03.1.03.1.0.rc13.1.0rc13.1.13.1.23.2.03.3.03.3.13.3.23.3.33.4.03.4.1 |
7.1.0 |
pillowPyPI |
before 7.1.0, plus listed versions 1.01.11.21.31.4 Show 45 moreShow less1.51.61.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.7.82.0.02.1.02.2.02.2.12.2.22.3.02.3.12.3.22.4.02.5.02.5.12.5.22.5.32.6.02.6.12.6.22.7.02.8.02.8.12.8.22.9.03.0.03.1.0rc13.1.0.rc13.1.03.1.13.1.23.2.03.3.03.3.13.3.23.3.33.4.03.4.1 |
7.1.0 |
pillowUbuntu:20.04:LTS |
before 7.0.0-4ubuntu0.1, plus listed versions 6.1.0-16.1.0-1build16.2.1-27.0.0-47.0.0-4build1 |
7.0.0-4ubuntu0.1 |
pillow-python2Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 6.2.1-3~build16.2.1-36.2.1-3ubuntu0.1~esm16.2.1-3ubuntu0.1~esm2 |
None known |
pillowUbuntu:20.04:LTS From an advisory covering 5 CVEs |
before 7.0.0-4ubuntu0.1, plus listed versions 6.1.0-16.1.0-1build16.2.1-27.0.0-47.0.0-4build1 |
7.0.0-4ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-10379 is a high vulnerability (CVSS 7.8) in Python Pillow, published June 25, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.13%, the 66th percentile. Fixed in pillow 7.1.0.
References
github.com/python-pillow/Pillow/commits/master/src/libImaging
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOKHNWV2VS5GESY7IBD237E7C6T3I427
pillow.readthedocs.io/en/stable/releasenotes/7.1.0.html
Show 18 moreShow less
usn.ubuntu.com/4430-2
nvd.nist.gov/vuln/detail/CVE-2020-10379
snyk.io/vuln/SNYK-PYTHON-PILLOW-574577
security-tracker.debian.org/tracker/CVE-2020-10379
ubuntu.com/security/CVE-2020-10379
cve.org/CVERecord?id=CVE-2020-10379
Left out here: 40 versions. The JSON record has them.