Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time

Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise

Pillow: TarIO negative size field causes infinite CPU-spin loop

Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips

Pillow: PDF Parsing Trailer Infinite Loop (DoS)

Pillow: Integer overflow when processing fonts

Pillow: Heap buffer overflow with nested list coordinates

Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1

Pillow: Image.quantize() with empty palette leaks uninitialized stack memory

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path