Every CVE whose affected-product data names Python Pillow, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (65)
CVE-2014-3007 — CVSS 10.0 (critical): Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell…
CVE-2021-34552 — CVSS 9.8 (critical): Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a…
CVE-2016-4009 — CVSS 9.8 (critical): Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have…
CVE-2021-25289 — CVSS 9.8 (critical): An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of…
CVE-2022-30595 — CVSS 9.8 (critical): libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.
CVE-2022-22817 — CVSS 9.8 (critical): PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A…
CVE-2021-25288 — CVSS 9.1 (critical): An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.
CVE-2022-24303 — CVSS 9.1 (critical): Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
CVE-2021-25287 — CVSS 9.1 (critical): An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.
CVE-2020-35654 — CVSS 8.8 (high): In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation…
CVE-2020-5310 — CVSS 8.8 (high): libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.
CVE-2020-11538 — CVSS 8.1 (high): In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different…
CVE-2023-50447 — CVSS 8.1 (high): Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than…
CVE-2026-42311 — CVSS 7.8 (high): Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory…
CVE-2016-9190 — CVSS 7.8 (high): Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an…
CVE-2021-27921 — CVSS 7.5 (high): Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is…
CVE-2023-44271 — CVSS 7.5 (high): An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task…
CVE-2026-25990 — CVSS 7.5 (high): Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted…
CVE-2026-40192 — CVSS 7.5 (high): Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a…
CVE-2026-55380 — CVSS 7.5 (high): Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header…
CVE-2019-16865 — CVSS 7.5 (high): An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very…
CVE-2019-19911 — CVSS 7.5 (high): There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer…
CVE-2026-55379 — CVSS 7.5 (high): Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file…
CVE-2026-54060 — CVSS 7.5 (high): Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap…
CVE-2026-54059 — CVSS 7.5 (high): Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section…
CVE-2021-23437 — CVSS 7.5 (high): The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
CVE-2021-25290 — CVSS 7.5 (high): An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.
CVE-2021-25291 — CVSS 7.5 (high): An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile…
CVE-2021-25293 — CVSS 7.5 (high): An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.
CVE-2022-45198 — CVSS 7.5 (high): Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).
CVE-2021-27922 — CVSS 7.5 (high): Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is…
CVE-2021-27923 — CVSS 7.5 (high): Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is…
CVE-2021-28676 — CVSS 7.5 (high): An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero…
CVE-2021-28677 — CVSS 7.5 (high): An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any…
CVE-2020-35653 — CVSS 7.1 (high): In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted…
CVE-2025-48379 — CVSS 7.1 (high): Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large…
CVE-2024-28219 — CVSS 6.7 (medium): In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
CVE-2022-22816 — CVSS 6.5 (medium): path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.
CVE-2016-0740 — CVSS 6.5 (medium): Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite…
CVE-2016-2533 — CVSS 6.5 (medium): Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier…
CVE-2016-0775 — CVSS 6.5 (medium): Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial…
CVE-2021-25292 — CVSS 6.5 (medium): An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file…
CVE-2026-42308 — CVSS 5.5 (medium): Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow…
CVE-2016-3076 — CVSS 5.5 (medium): Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of…
CVE-2016-9189 — CVSS 5.5 (medium): Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related…
CVE-2020-10378 — CVSS 5.5 (medium): In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed…
CVE-2020-10994 — CVSS 5.5 (medium): In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.
CVE-2021-28675 — CVSS 5.5 (medium): An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to…
CVE-2021-28678 — CVSS 5.5 (medium): An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file…
CVE-2026-42309 — CVSS 5.5 (medium): Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept…
CVE-2026-42310 — CVSS 5.5 (medium): Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the…
CVE-2020-35655 — CVSS 5.4 (medium): In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length…
CVE-2014-9601 — CVSS 5.0 (medium): Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size…
CVE-2014-3598 — CVSS 5.0 (medium): The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image.
CVE-2014-3589 — CVSS 5.0 (medium): PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a…
CVE-2026-55798 — CVSS 4.5 (medium): Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding…
CVE-2014-1932 — CVSS 4.4 (medium): The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py…
CVE-2014-1933 — CVSS 2.1 (low): The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses…