Product by Python-pillow
Pillow
58 known vulnerabilities in Pillow (Python-pillow), 0 of them actively exploited (CISA KEV).
Key figures
58
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
6
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-112900 | Pillow: Argument Injection in Ghostscript call, potentially leading into RCE | 9.8 | |
| Critical | CVE-2026-112393 | Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO | 9.8 | |
| Critical | CVE-2026-112403 | Pillow: Heap buffer overflow in ImagingJpegDecode | 9.8 | |
| Critical | CVE-2026-96639 | Pillow multi-frame loaders can reuse stale native image storage after mode transitions | 9.8 | |
| Critical | CVE-2026-112398 | Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution | 9.8 | |
| High | CVE-2026-112390 | Pillow: Infinite loop in MIC n_frames when the embedded TIFF | 7.5 | |
| High | CVE-2026-96778 | Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer | 8.8 | |
| High | CVE-2026-112897 | Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips | 6.2 | |
| High | CVE-2026-112894 | Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id) | 7.5 | |
| High | CVE-2026-112402 | Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform | 7.5 | |
| High | CVE-2026-112400 | Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS | 7.5 | |
| High | CVE-2026-112896 | Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read | 7.1 | |
| High | CVE-2026-112397 | Pillow: Out-of-bounds access in _imagingmorph on a zero-width image | 7.5 | |
| High | CVE-2026-96640 | Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion | 7.5 | |
| High | CVE-2026-112394 | Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size | 8.2 | |
| High | CVE-2026-112396 | Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer | 7.5 | |
| High | CVE-2026-112391 | Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree() | 7.5 | |
| High | CVE-2026-112392 | Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images | 7.5 | |
| High | CVE-2026-112895 | Python-pillow Pillow: Uncontrolled Recursion | 7.5 | |
| High | CVE-2026-112892 | Pillow: MSP RLE decoder expands a tiny file into unbounded memory | 7.5 | |
| High | CVE-2026-112406 | Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle | 7.5 | |
| High | CVE-2026-112405 | Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0 | 7.5 | |
| High | CVE-2026-112404 | Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels | 8.2 | |
| High | CVE-2026-112399 | Pillow: APNG background disposal allocates full canvas before decompression bomb check | 7.5 | |
| Critical | CVE-2026-54058 | Python-pillow Pillow: Out-of-bounds Read | 9.1 |