python-pillow/pillow Security Advisories | GitStock

critical2026-10-20

Pillow: Heap buffer overflow in ImagingJpegDecode

GHSA-8g5g-8vmr-9782 · CVE-2026-112403

high2026-07-20

Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch

GHSA-9hw9-ch79-4vh6 · CVE-2026-59205

high2026-07-20

Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

GHSA-vjc4-5qp5-m44j · CVE-2026-59204

medium2026-07-20

Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service

GHSA-pg7v-jwj7-p798 · CVE-2026-59203

high2026-07-20

Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

GHSA-jjj6-mw9f-p565 · CVE-2026-59200

high2026-07-20

Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

GHSA-6r8x-57c9-28j4 · CVE-2026-59199

medium2026-07-20

Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

GHSA-fj7v-r99m-22gq · CVE-2026-59198

high2026-07-20

Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

GHSA-xj96-63gp-2gmr · CVE-2026-59197

medium2026-07-20

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

GHSA-4x4j-2g7c-83w6 · CVE-2026-55798

high2026-07-20

Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`

GHSA-phj9-mv4w-65pm · CVE-2026-55380

high2026-07-20

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

GHSA-45hq-cxwh-f6vc · CVE-2026-55379

high2026-07-20

Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

GHSA-5x94-69rx-g8h2 · CVE-2026-54060

high2026-07-20

Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

GHSA-8v84-f9pq-wr9x · CVE-2026-54059

high2026-07-20

Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

GHSA-62p4-gmf7-7g93 · CVE-2026-54058

high2026-05-04

Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)

GHSA-pwv6-vv43-88gr · CVE-2026-42311

medium2026-05-04

Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

GHSA-r73j-pqj5-w3x7 · CVE-2026-42310

medium2026-05-04

Pillow has an integer overflow when processing fonts

GHSA-wjx4-4jcj-g98j · CVE-2026-42308

medium2026-05-04

Pillow has a heap buffer overflow with nested list coordinates

GHSA-5xmw-vc9v-4wf2 · CVE-2026-42309

high2026-04-13

FITS GZIP decompression bomb in Pillow

GHSA-whj4-6x5x-4v2j · CVE-2026-40192

high2026-02-11

Pillow affected by out-of-bounds write when loading PSD images

GHSA-cfh3-3jmp-rvhc · CVE-2026-25990