Every CVE Search/ Get API key

CVE-2016-9190

Arbitrary code using "crafted image file" approach affecting Pillow

7.8 HighFix available

Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.90%Up 0.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.8

Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.

Record
CVE-2016-9190
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-284
Updated
2026-11-02
CVE List No score

Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.

Record
CVE-2016-9190
Updated
2026-11-02
EUVDEUVD-2016-0025 No score

Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.

Record
EUVD-2016-0025
Updated
2026-11-03
GitHub AdvisoriesGHSA-w4vg-rf63-f3j3 8.7

Arbitrary code using "crafted image file" approach affecting Pillow

Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.

Record
GHSA-w4vg-rf63-f3j3
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-284
Updated
2026-11-02
OSV 7.8

Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.

Record
CVE-2016-9190
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2016-9190 7.8

Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.

Record
DEBIAN-CVE-2016-9190
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVGHSA-w4vg-rf63-f3j3 8.7

Arbitrary code using "crafted image file" approach affecting Pillow

Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.

Record
GHSA-w4vg-rf63-f3j3
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-284
Updated
2026-11-02
OSVUBUNTU-CVE-2016-9190 7.8

Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.

Record
UBUNTU-CVE-2016-9190
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2016-0383 No score

Updated python-pillow packages fix security vulnerabilities

It was discovered that there were a number of memory overflow issues in python-pillow, a Python image manipulation library. (CVE-2016-9189 and CVE-2016-9190)

Record
MGASA-2016-0383
Updated
2026-11-02
OSVPYSEC-2016-9 No score

Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.

Record
PYSEC-2016-9
Updated
2026-11-02
OSVSUSE-SU-2018:1174-1 No score

Security update for python-Pillow

This update for python-Pillow fixes the following issues:

  • CVE-2016-9190: Pillow allows context-dependent attackers to execute arbitrary code by using the 'crafted image file' approach, related to an 'Insecure Sign Extension' issue affecting the ImagingNew in Storage.c component. (bsc#1008846)

  • CVE-2016-3076: Heap-based buffer overflow in the j2k_encode_entry function allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file. (bsc#973786)

Record
SUSE-SU-2018:1174-1
Updated
2026-11-02
OSVSUSE-SU-2018:1191-1 No score

Security update for python-Pillow

This update for python-Pillow fixes the following issues:

  • CVE-2016-9190: Pillow allows context-dependent attackers to execute arbitrary code by using the 'crafted image file' approach, related to an 'Insecure Sign Extension' issue affecting the ImagingNew in Storage.c component. (bsc#1008846)

  • CVE-2016-3076: Heap-based buffer overflow in the j2k_encode_entry function allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file. (bsc#973786)

Record
SUSE-SU-2018:1191-1
Updated
2026-11-02
OSVSUSE-SU-2019:1321-1 No score

Security update for python-Pillow

This update for python-Pillow fixes the following issues:

Security issues fixed:

  • CVE-2016-9189: Fixed a integer overflows leading to memory disclosure in PyImaging_MapBuffer() (bsc#1008845).
  • CVE-2016-9190: Fixed a code execution vulnerability using a crafted image file in ImagingNew() (bsc#1008846).
  • CVE-2016-3076: Fixed a integer overflow in j2k_encode_entry() (bsc#973786)
Record
SUSE-SU-2019:1321-1
Updated
2026-11-02
OSVUSN-3230-1 No score

pillow vulnerabilities

It was discovered that Pillow incorrectly handled certain compressed text chunks in PNG images. A remote attacker could possibly use this issue to cause Pillow to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-9601)

Cris Neckar discovered that Pillow incorrectly handled certain malformed images. A remote attacker could use this issue to cause Pillow to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2016-9189)

Cris Neckar discovered that Pillow incorrectly handled certain malformed images. A remote attacker could use this issue to cause Pillow to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-9190)

Record
USN-3230-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pillow
PyPI
 before 3.3.2
3.3.2
pillow
Debian:12
 before 3.4.2-1
3.4.2-1
pillow
Debian:13
 before 3.4.2-1
3.4.2-1
pillow
Debian:14
 before 3.4.2-1
3.4.2-1
python-imaging
Debian:7
 before 1.1.7-4+deb7u3, plus listed versions
1.1.7-41.1.7-4+deb7u11.1.7-4+deb7u2
1.1.7-4+deb7u3
pillow
Debian:8
 before 2.6.1-2+deb8u3, plus listed versions
2.6.1-22.6.1-2+deb8u12.6.1-2+deb8u2
2.6.1-2+deb8u3
pillow
PyPI
 before 3.3.2, plus listed versions
1.01.11.21.31.4
Show 41 moreShow less
1.51.61.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.7.82.0.02.1.02.2.02.2.12.2.22.3.02.3.12.3.22.4.02.5.02.5.12.5.22.5.32.6.02.6.12.6.22.7.02.8.02.8.12.8.22.9.03.0.03.1.03.1.0.rc13.1.0rc13.1.13.1.23.2.03.3.03.3.1
3.3.2
python-pillow
Mageia:5
 before 2.6.2-2.6.mga5
2.6.2-2.6.mga5
python-Pillow
SUSE:OpenStack Cloud 7
 before 2.8.1-4.3.2
2.8.1-4.3.2
python-Pillow
SUSE:Enterprise Storage 4
 before 2.8.1-4.3.2
2.8.1-4.3.2
Show 4 moreShow less
Affected packages
PackageAffectedFixed
python-Pillow
SUSE:OpenStack Cloud 6
 before 2.7.0-4.3.1
2.7.0-4.3.1
python-Pillow
SUSE:Enterprise Storage 5
 before 2.8.1-3.3.1
2.8.1-3.3.1
pillow
Ubuntu:14.04:LTS
 before 2.3.0-1ubuntu3.4, plus listed versions
2.2.1-1ubuntu22.2.1-2ubuntu12.2.1-3ubuntu22.2.1-3ubuntu32.2.1-3ubuntu4
Show 6 moreShow less
2.2.1-3ubuntu62.3.0-1ubuntu12.3.0-1ubuntu22.3.0-1ubuntu32.3.0-1ubuntu3.22.3.0-1ubuntu3.3
2.3.0-1ubuntu3.4
pillow
Ubuntu:16.04:LTS
 before 3.1.2-0ubuntu1.1, plus listed versions
2.9.0-13.0.0-13.0.0-1build13.1.0-13.1.1-13.1.2-0ubuntu1
3.1.2-0ubuntu1.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-9190 is a high vulnerability (CVSS 7.8) in Python Pillow, published November 4, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.90%, the 79th percentile. Fixed in pillow 3.3.2.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open