PI
Product
Pillow
111
CVEs
0
On KEV
9.8
Max CVSS
38
New 30D
Severity mix
Critical 16High 60Medium 29Low 0
Watch
Add Pillow to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-9189 | 5.5 | Nov 4 | Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer Overflow" issue affecting… Affected: through 3.3.1 |
| CVE-2020-35655 | 5.4 | Jan 12 | In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled Affected: 4.3.0 before 8.1.0 |
| CVE-2026-114501 New | 5.3 | Oct 21 | Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1 Affected: 11.2.1 before 13.0.0 |
| CVE-2026-112898 | 5.3 | Oct 19 | Pillow: Image.quantize() with empty palette leaks uninitialized stack memory Affected: 9.1.0 before 13.0.0 |
| CVE-2026-55798 | 4.5 | Jul 6 | Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path Affected: before 12.3.0 |
| CVE-2014-3598 | – | May 1 | The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image Affected: through 2.5.2 |
| CVE-2014-9601 | – | Jan 16 | Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed Affected: through 2.6.2 |
| CVE-2014-3589 | – | Aug 25 | PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size Affected: through 2.3.1; 2.3.0; 2.5.0; 2.5.1; 2.5.2 |
| CVE-2014-3007 | – | Apr 27 | Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to… Affected: 2.3.0 |
| CVE-2014-1933 | – | Apr 17 | The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the… Affected: through 2.3.0 |
| CVE-2014-1932 | – | Apr 17 | The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in… Affected: through 2.3.0 |