Every CVE Search/ Get API key

CVE-2022-45198

Pillow vulnerable to Data Amplification attack.

7.5 HighFix available

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.30%Up 0.4 points since Nov 14, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).

Record
CVE-2022-45198
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
CVE List No score

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).

Record
CVE-2022-45198
Updated
2026-11-02
EUVDEUVD-2022-0197 No score

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).

Record
EUVD-2022-0197
Updated
2026-11-03
GitHub AdvisoriesGHSA-m2vv-5vj5-2hm7 8.7

Pillow vulnerable to Data Amplification attack.

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).

Record
GHSA-m2vv-5vj5-2hm7
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-409
Updated
2026-11-02
OSVGHSA-m2vv-5vj5-2hm7 8.7

Pillow vulnerable to Data Amplification attack.

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).

Record
GHSA-m2vv-5vj5-2hm7
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-409
Updated
2026-11-02
OSVOESA-2023-1923 7.5

python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift.

Security Fix(es):

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).(CVE-2022-45198)

Record
OESA-2023-1923
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 12 moreShow less
OSVUBUNTU-CVE-2022-45198 7.5

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).

Record
UBUNTU-CVE-2022-45198
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBIT-pillow-2022-45198 No score

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).

Record
BIT-pillow-2022-45198
Updated
2026-11-02
OSVCLSA-2026-1772410256 No score

TuxCare security update for pillow (3 CVEs)

TuxCare rebuilt pillow to address 3 CVEs. Fixed in 8.4.0.post1+tuxcare.

Record
CLSA-2026-1772410256
Updated
2026-11-02
OSV No score

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).

Record
CVE-2022-45198
Updated
2026-11-02
OSVDEBIAN-CVE-2022-45198 No score

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).

Record
DEBIAN-CVE-2022-45198
Updated
2026-11-03
OSVMGASA-2023-0164 No score

Updated python-pillow packages fix security vulnerability

libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files. (CVE-2022-30595) Improper Handling of Highly Compressed GIF Data (Data Amplification). (CVE-2022-45198)

Record
MGASA-2023-0164
Updated
2026-11-02
OSVopenSUSE-SU-2024:0253-1 No score

Security update for python-Pillow

This update for python-Pillow fixes the following issues:

  • CVE-2022-45198: Fixed improper handling of highly compressed GIF data (boo#1205416)
Record
openSUSE-SU-2024:0253-1
Updated
2026-11-02
OSVPYSEC-2022-42979 No score

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).

Record
PYSEC-2022-42979
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2022-45198 No score

CVE-2022-45198 in pillow - Patched by Root

Root has patched CVE-2022-45198 in the pillow package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2022-45198
Updated
2026-11-05
OSVSUSE-SU-2024:2908-1 No score

Security update for python-Pillow

This update for python-Pillow fixes the following issues:

  • CVE-2022-45198: Fixed improper handling of highly compressed GIF data (bsc#1205416)
Record
SUSE-SU-2024:2908-1
Updated
2026-11-02
OSVUSN-5777-1 No score

pillow vulnerabilities

It was discovered that Pillow incorrectly handled the deletion of temporary files when using a temporary directory that contains spaces. An attacker could possibly use this issue to delete arbitrary files. This issue only affected Ubuntu 20.04 LTS. (CVE-2022-24303)

It was discovered that Pillow incorrectly handled the decompression of highly compressed GIF data. An attacker could possibly use this issue to cause Pillow to crash, resulting in a denial of service. (CVE-2022-45198)

Record
USN-5777-1
Updated
2026-11-02
OSVUSN-5777-2 No score

pillow-python2 vulnerabilities

USN-5777-1 fixed vulnerabilities in Pillow (Python 3). This update provides the corresponding updates for Pillow (Python 2) in Ubuntu 20.04 LTS.

Original advisory details:

It was discovered that Pillow incorrectly handled the deletion of temporary files when using a temporary directory that contains spaces. An attacker could possibly use this issue to delete arbitrary files. This issue only affected Ubuntu 20.04 LTS. (CVE-2022-24303)

It was discovered that Pillow incorrectly handled the decompression of highly compressed GIF data. An attacker could possibly use this issue to cause Pillow to crash, resulting in a denial of service. (CVE-2022-45198)

Record
USN-5777-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pillow
PyPI
 before 9.2.0
9.2.0
pillow
Bitnami
 before 9.2.0
9.2.0
pillow
TuxCare:PyPI
From an advisory covering 3 CVEs
 8.4.0 up to 8.4.0.post1+tuxcare
8.4.0.post1+tuxcare
pillow
Debian:12
 before 9.2.0-1
9.2.0-1
pillow
Debian:13
 before 9.2.0-1
9.2.0-1
pillow
Debian:14
 before 9.2.0-1
9.2.0-1
pillow
Debian:11
From an advisory covering 3 CVEs
 before 8.1.2+dfsg-0.3+deb11u3, plus listed versions
8.1.2+dfsg-0.38.1.2+dfsg-0.3+deb11u18.1.2+dfsg-0.3+deb11u2
8.1.2+dfsg-0.3+deb11u3
pillow
PyPI
 before 9.2.0, plus listed versions
1.01.11.21.31.4
Show 45 moreShow less
1.51.61.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.7.82.0.02.1.02.2.02.2.12.2.22.3.02.3.12.3.22.4.02.5.02.5.12.5.22.5.32.6.02.6.12.6.22.7.02.8.02.8.12.8.22.9.03.0.03.1.03.1.0.rc13.1.0rc13.1.13.1.23.2.03.3.03.3.13.3.23.3.33.4.03.4.1
9.2.0
python-pillow
Mageia:8
From an advisory covering 2 CVEs
 before 9.2.0-1.mga8
9.2.0-1.mga8
python-pillow
openEuler:20.03-LTS-SP1
 before 9.0.1-5.oe1
9.0.1-5.oe1
Show 16 moreShow less
Affected packages
PackageAffectedFixed
python-pillow
openEuler:20.03-LTS-SP3
 before 9.0.1-5.oe1
9.0.1-5.oe1
python-pillow
openEuler:22.03-LTS
 before 9.0.1-5.oe2203sp2
9.0.1-5.oe2203sp2
python-pillow
openEuler:22.03-LTS-SP1
 before 9.0.1-5.oe2203sp1
9.0.1-5.oe2203sp1
python-pillow
openEuler:22.03-LTS-SP2
 before 9.0.1-5.oe2203sp2
9.0.1-5.oe2203sp2
pillow
PyPI
 before 9.2.0, plus listed versions
1.01.11.21.31.4
Show 45 moreShow less
1.51.61.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.7.82.0.02.1.02.2.02.2.12.2.22.3.02.3.12.3.22.4.02.5.02.5.12.5.22.5.32.6.02.6.12.6.22.7.02.8.02.8.12.8.22.9.03.0.03.1.03.1.0.rc13.1.0rc13.1.13.1.23.2.03.3.03.3.13.3.23.3.33.4.03.4.1
9.2.0
pillow
Root:PyPI
 before 9.0.1+aikido.1
9.0.1+aikido.19.0.1+aikido.28.0.1+aikido.18.1.2+aikido.18.0.1+aikido.28.2.0+aikido.19.0.0+aikido.19.0.0+aikido.27.0.0+aikido.27.0.0+aikido.3
python-Pillow
SUSE:Linux Enterprise Module for Package Hub 15 SP6
 before 7.2.0-150300.3.18.1
7.2.0-150300.3.18.1
python-Pillow
openSUSE:Leap 15.5
 before 7.2.0-150300.3.18.1
7.2.0-150300.3.18.1
pillow
Ubuntu:20.04:LTS
 before 7.0.0-4ubuntu0.7, plus listed versions
6.1.0-16.1.0-1build16.2.1-27.0.0-47.0.0-4build1
Show 6 moreShow less
7.0.0-4ubuntu0.17.0.0-4ubuntu0.27.0.0-4ubuntu0.37.0.0-4ubuntu0.47.0.0-4ubuntu0.57.0.0-4ubuntu0.6
7.0.0-4ubuntu0.7
pillow-python2
Ubuntu:Pro:20.04:LTS
 before 6.2.1-3ubuntu0.1~esm1, plus listed versions
6.2.1-3~build16.2.1-3
6.2.1-3ubuntu0.1~esm1
pillow
Ubuntu:22.04:LTS
 before 9.0.1-1ubuntu0.1, plus listed versions
8.1.2+dfsg-0.39.0.0-19.0.1-19.0.1-1build1
9.0.1-1ubuntu0.1
pillow
Ubuntu:20.04:LTS
From an advisory covering 2 CVEs
 before 7.0.0-4ubuntu0.7, plus listed versions
6.1.0-16.1.0-1build16.2.1-27.0.0-47.0.0-4build1
Show 6 moreShow less
7.0.0-4ubuntu0.17.0.0-4ubuntu0.27.0.0-4ubuntu0.37.0.0-4ubuntu0.47.0.0-4ubuntu0.57.0.0-4ubuntu0.6
7.0.0-4ubuntu0.7
pillow
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 9.0.1-1ubuntu0.1, plus listed versions
8.1.2+dfsg-0.39.0.0-19.0.1-19.0.1-1build1
9.0.1-1ubuntu0.1
pillow-python2
Ubuntu:Pro:20.04:LTS
From an advisory covering 2 CVEs
 before 6.2.1-3ubuntu0.1~esm1, plus listed versions
6.2.1-3~build16.2.1-3
6.2.1-3ubuntu0.1~esm1
python-Pillow
SUSE:Package Hub 15 SP5
 before 8.4.0-bp155.3.9.1
8.4.0-bp155.3.9.1
python-Pillow
openSUSE:Leap 15.5
 before 8.4.0-bp155.3.9.1
8.4.0-bp155.3.9.1

History

History
RecordedChangedSources
affected
affectedOSV
affectedOSV
affected, factsOSV
affectedOSV
affectedOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-45198 is a high vulnerability (CVSS 7.5) in Python Pillow, published November 14, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.30%, the 70th percentile. Fixed in pillow 9.2.0.

References

Show 20 moreShow less
This page doesn't list everything

Left out here: 81 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open