PI
Product
Pillow
56
CVEs
0
On KEV
9.8
Max CVSS
38
New 30D
Severity mix
Critical 6High 37Medium 13Low 0
Watch
Add Pillow to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-96639 New | 9.8 | Oct 21 | Pillow multi-frame loaders can reuse stale native image storage after mode transitions Affected: >= 11.0.0, < 13.0.0 |
| CVE-2026-112900 | 9.8 | Oct 19 | Pillow: Argument Injection in Ghostscript call, potentially leading into RCE Affected: >= 2.6.0, < 13.0.0 |
| CVE-2026-112403 | 9.8 | Oct 19 | Pillow: Heap buffer overflow in ImagingJpegDecode Affected: < 13.0.0 |
| CVE-2026-112398 | 9.8 | Oct 19 | Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution Affected: < 13.0.0 |
| CVE-2026-112393 | 9.8 | Oct 19 | Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO Affected: >= 2.0.0, < 13.0.0 |
| CVE-2026-54058 | 9.1 | Jul 14 | Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files) Affected: < 12.3.0 |
Showing 6