Python-pillow vulnerabilities
We track 47 vulnerabilities in Python-pillow products. 47 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest Python-pillow vulnerabilities
- 7.5 High severity
Pillow: Memory Allocation with Excessive Size Value
Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger exc
- 7.5 High severity
Pillow: Memory Allocation with Excessive Size Value
Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pi
- 7.5 High severity
Pillow: Memory Allocation with Excessive Size Value
Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessiv
- 7.5 High severity
Pillow: Memory Allocation with Excessive Size Value
Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF fon
- 7.8 High severity
Pillow: Integer Overflow or Wraparound
Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.
- 7.5 High severity
Pillow: Uncontrolled Resource Consumption
Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memor
- 7.5 High severity
Pillow: Out-of-bounds Write
Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.