Every CVE Search/ Get API key

CVE-2022-45199

Pillow subject to DoS via SAMPLESPERPIXEL tag

7.5 HighFix available

Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.21%Up 0.3 points since Nov 14, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.

Record
CVE-2022-45199
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
CVE List No score

Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.

Record
CVE-2022-45199
Updated
2026-11-02
EUVDEUVD-2022-0198 No score

Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.

Record
EUVD-2022-0198
Updated
2026-11-03
GitHub AdvisoriesGHSA-q4mp-jvh2-76fj 8.7

Pillow subject to DoS via SAMPLESPERPIXEL tag

Pillow starting with 9.2.0 and prior to 9.3.0 allows denial of service via SAMPLESPERPIXEL. A large value in the SAMPLESPERPIXEL tag could lead to a memory and runtime DOS in TiffImagePlugin.py when setting up the context for image decoding. This issue has been patched in version 9.3.0.

Record
GHSA-q4mp-jvh2-76fj
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVGHSA-q4mp-jvh2-76fj 8.7

Pillow subject to DoS via SAMPLESPERPIXEL tag

Pillow starting with 9.2.0 and prior to 9.3.0 allows denial of service via SAMPLESPERPIXEL. A large value in the SAMPLESPERPIXEL tag could lead to a memory and runtime DOS in TiffImagePlugin.py when setting up the context for image decoding. This issue has been patched in version 9.3.0.

Record
GHSA-q4mp-jvh2-76fj
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVOESA-2022-2113 7.5

python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift.

Security Fix(es):

Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.(CVE-2022-45199)

Record
OESA-2022-2113
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVOESA-2023-1024 7.5

python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift.

Security Fix(es):

Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.(CVE-2022-45199)

Record
OESA-2023-1024
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBIT-pillow-2022-45199 No score

Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.

Record
BIT-pillow-2022-45199
Updated
2026-11-02
OSV No score

Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.

Record
CVE-2022-45199
Updated
2026-11-02
OSVDEBIAN-CVE-2022-45199 No score

Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.

Record
DEBIAN-CVE-2022-45199
Updated
2026-11-03
OSVPYSEC-2022-42980 No score

Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.

Record
PYSEC-2022-42980
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pillow
PyPI
 9.2.0 up to 9.3.0
9.3.0
pillow
Bitnami
 before 9.3.0
9.3.0
pillow
Debian:12
 before 9.3.0-1
9.3.0-1
pillow
Debian:13
 before 9.3.0-1
9.3.0-1
pillow
Debian:14
 before 9.3.0-1
9.3.0-1
python-pillow
openEuler:20.03-LTS-SP1
 before 9.0.1-2.oe1
9.0.1-2.oe1
python-pillow
openEuler:20.03-LTS-SP3
 before 9.0.1-2.oe1
9.0.1-2.oe1
python-pillow
openEuler:22.03-LTS
 before 9.0.1-3.oe2203
9.0.1-3.oe2203
python-pillow
openEuler:22.03-LTS-SP1
 before 9.0.1-3.oe2203sp1
9.0.1-3.oe2203sp1
pillow
PyPI
 9.2.0 up to 9.3.0, plus listed versions
9.1.09.0.08.4.08.3.08.2.0
Show 40 moreShow less
8.1.08.0.07.2.07.1.07.0.06.2.06.1.06.0.05.4.05.3.05.2.05.1.05.0.04.3.04.2.04.1.04.0.04.0.0a3.4.03.3.03.2.03.1.03.1.0-rc12.9.02.9.0.dev22.9.0.dev12.9.0.dev02.8.12.8.02.7.02.5.02.3.02.2.12.2.02.1.02.0.01.7.81.7.71.21.0
9.3.0

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-45199 is a high vulnerability (CVSS 7.5) in Python Pillow, published November 14, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.21%, the 68th percentile. Fixed in pillow 9.3.0.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open