Skip to contentPython-pillow Pillow vulnerabilities
- python pillowPillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`CVE-2026-54060Fix available7.5 High
- python pillowPillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loadingCVE-2026-54059Fix available7.5 High
- python pillowPillow: WindowsViewer.get_command() OS command injection via unescaped shell pathCVE-2026-55798Fix available4.5 Medium
- python pillowPillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow)CVE-2026-42311Fix available8.6 High
- python pillowPillow: PDF Parsing Trailer Infinite Loop (DoS)CVE-2026-42310Fix available5.1 Medium
- python pillowPillow: Integer overflow when processing fontsCVE-2026-42308Fix available5.1 Medium
- python pillowPillow: Heap buffer overflow with nested list coordinatesCVE-2026-42309Fix available5.1 Medium
- python pillow, red hat lightspeed core, openshift lightspeed +27 more +29 morePillow is vulnerable to a FITS GZIP decompression bombCVE-2026-40192Fix available8.7 High
- python pillow, red hat openshift lightspeed, ai inference server +24 more +26 morePillow has an out-of-bounds write when loading PSD imagesCVE-2026-25990Fix available8.6 High
- python pillowPillow Vulnerable to Write Buffer Overflow on BCn encodingCVE-2025-48379Fix available7.1 High
- python pillow, fedoraproject fedora +1 moreRegular Expression Denial of Service (ReDoS)CVE-2021-23437Fix available7.5 High