PI
Product
Pillow
56
CVEs
0
On KEV
9.8
Max CVSS
38
New 30D
Severity mix
Critical 6High 37Medium 13Low 0
Watch
Add Pillow to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-42310 | 5.5 | May 9 | Pillow: PDF Parsing Trailer Infinite Loop (DoS) Affected: >= 4.2.0, < 12.2.0 |
| CVE-2026-42308 | 5.5 | May 9 | Pillow: Integer overflow when processing fonts Affected: < 12.2.0 |
| CVE-2026-42309 | 5.5 | May 9 | Pillow: Heap buffer overflow with nested list coordinates Affected: >= 11.2.1, < 12.2.0 |
| CVE-2026-114501 New | 5.3 | Oct 21 | Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1 Affected: >= 11.2.1, < 13.0.0 |
| CVE-2026-112898 | 5.3 | Oct 19 | Pillow: Image.quantize() with empty palette leaks uninitialized stack memory Affected: >= 9.1.0, < 13.0.0 |
| CVE-2026-55798 | 4.5 | Jul 6 | Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path Affected: < 12.3.0 |