Python-pillow Pillow vulnerabilities

• python-pillow pillow Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags CVE-2026-112902 Fix available 8.3 HighOctober 21, 2026
• python pillow Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1 CVE-2026-114501 Fix available 6.3 MediumOctober 21, 2026
• python pillow Pillow multi-frame loaders can reuse stale native image storage after mode transitions CVE-2026-96639 Fix available 9.8 CriticalOctober 21, 2026
• python pillow Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek) CVE-2026-96636 Fix available 6.5 MediumOctober 21, 2026
• python pillow Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS CVE-2026-96637 Fix available 7.1 HighOctober 21, 2026
• python pillow Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer CVE-2026-96778 Public exploitFix available 7.7 HighOctober 21, 2026
• python pillow Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time CVE-2026-96643 Fix available 7.1 HighOctober 21, 2026
• python pillow Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds) CVE-2026-96644 Fix available 7.1 HighOctober 21, 2026
• python pillow Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise CVE-2026-96641 Fix available 6.5 MediumOctober 21, 2026
• python pillow Pillow: TarIO negative size field causes infinite CPU-spin loop CVE-2026-96642 Fix available 7.1 HighOctober 21, 2026
• python pillow Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode CVE-2026-96638 Fix available 6.5 MediumOctober 21, 2026
• python pillow Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion CVE-2026-96640 Fix available 8.2 HighOctober 21, 2026
• python-pillow pillow Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit CVE-2026-112899 Fix available 6.3 MediumOctober 20, 2026
• python pillow Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes CVE-2026-112901 Fix available 6.9 MediumOctober 19, 2026
• python pillow Pillow: Argument Injection in Ghostscript call, potentially leading into RCE CVE-2026-112900 Public exploitFix available 9.2 CriticalOctober 19, 2026
• python pillow Pillow: Image.quantize() with empty palette leaks uninitialized stack memory CVE-2026-112898 Fix available 6.9 MediumOctober 19, 2026
• python pillow Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips CVE-2026-112897 Fix available 8.7 HighOctober 19, 2026
• python pillow Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read CVE-2026-112896 Fix available 8.8 HighOctober 19, 2026
• python pillow Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310) CVE-2026-112895 Fix available 8.7 HighOctober 19, 2026
• python pillow Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id) CVE-2026-112894 Fix available 8.7 HighOctober 19, 2026
• python pillow Pillow: Invalid free in FreeType glyph rendering when a stroker is active CVE-2026-112893 Fix available 8.2 HighOctober 19, 2026
• python pillow Pillow: MSP RLE decoder expands a tiny file into unbounded memory CVE-2026-112892 Fix available 8.7 HighOctober 19, 2026
• python pillow Pillow: Quadratic GIF comment copying during save CVE-2026-112891 Fix available 6.9 MediumOctober 19, 2026
• python pillow Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle CVE-2026-112406 Fix available 8.7 HighOctober 19, 2026
• python pillow Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0 CVE-2026-112405 Fix available 8.7 HighOctober 19, 2026
• python pillow Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels CVE-2026-112404 Fix available 8.8 HighOctober 19, 2026
• python pillow Pillow: Heap buffer overflow in ImagingJpegDecode CVE-2026-112403 Public exploitFix available 9.2 CriticalOctober 19, 2026
• python pillow Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform CVE-2026-112402 Fix available 8.7 HighOctober 19, 2026
• python pillow Pillow: Out-of-bounds access in _imagingmorph on a zero-width image CVE-2026-112397 Fix available 8.7 HighOctober 19, 2026
• python pillow Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images CVE-2026-112392 Fix available 8.2 HighOctober 19, 2026
• python pillow Pillow: Quadratic GIF comment concatenation allows DoS in Image.open() CVE-2026-112401 Fix available 6.9 MediumOctober 19, 2026
• python pillow Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS CVE-2026-112400 Fix available 8.7 HighOctober 19, 2026
• python pillow Pillow: APNG background disposal allocates full canvas before decompression bomb check CVE-2026-112399 Fix available 8.7 HighOctober 19, 2026
• python pillow Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution CVE-2026-112398 Public exploitFix available 9.2 CriticalOctober 19, 2026
• python pillow Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer CVE-2026-112396 Fix available 5.9 MediumOctober 19, 2026
• python pillow Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290) CVE-2026-112395 Fix available 6.5 MediumOctober 19, 2026
• python pillow Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size CVE-2026-112394 Fix available 6.3 MediumOctober 19, 2026
• python pillow Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO CVE-2026-112393 Fix available 9.2 CriticalOctober 19, 2026
• python pillow Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree() CVE-2026-112391 Fix available 6.3 MediumOctober 19, 2026
• python pillow Pillow: Infinite loop in MIC n_frames when the embedded TIFF CVE-2026-112390 Fix available 8.2 HighOctober 19, 2026
• python pillow Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files) CVE-2026-54058 Fix available 8.3 HighJuly 14, 2026
• python pillow Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand` CVE-2026-59197 Fix available 8.2 HighJuly 14, 2026
• python pillow Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode() CVE-2026-59200 Fix available 7.5 HighJuly 14, 2026
• python pillow Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images CVE-2026-59198 Fix available 6.5 MediumJuly 14, 2026
• python pillow Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch CVE-2026-59205 Fix available 7.5 HighJuly 14, 2026
• python pillow Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service CVE-2026-59203 Fix available 5.3 MediumJuly 14, 2026
• python pillow Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow CVE-2026-59199 Fix available 7.5 HighJuly 14, 2026
• python pillow Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service CVE-2026-59204 Fix available 8.7 HighJuly 14, 2026
• python pillow Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading CVE-2026-55379 Fix available 7.5 HighJuly 6, 2026
• python pillow Pillow GdImageFile decompression bomb protection bypass CVE-2026-55380 Fix available 7.5 HighJuly 6, 2026
• Show olderLoading…