| Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromiseCVE-2026-96641 · GHSA-4RM8-3HMM-39FGVersion ranges need review. |
pillowExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1CVE-2026-114501 · GHSA-654X-CWWV-5J9CVersion ranges need review. |
pillowExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoSCVE-2026-96637 · GHSA-G842-9RC4-69PWVersion ranges need review. |
pillowExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)CVE-2026-96636 · GHSA-P8HX-V2P6-RP84Version ranges need review. |
pillowExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Pillow: TarIO negative size field causes infinite CPU-spin loopCVE-2026-96642 · GHSA-3J72-P6QG-6XP7Version ranges need review. |
pillowExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Pillow multi-frame loaders can reuse stale native image storage after mode transitionsCVE-2026-96639 · GHSA-V9PV-5GC8-W2M6Version ranges need review. |
pillowExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Critical
|
Fix reported |
|
| Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutesCVE-2026-112901 · GHSA-XGH8-JP6Q-P5X8Version ranges need review. |
pillowExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Pillow: Heap use-after-free when encoding TIFF to an in-memory bufferCVE-2026-112396 · GHSA-4RR5-89J8-MWWMVersion ranges need review. |
pillowExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer sizeCVE-2026-112394 · GHSA-4558-3H8R-V8XPVersion ranges need review. |
pillowExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute modeCVE-2026-96638 · GHSA-24RC-8HJ2-V98C |
pillowExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tagsCVE-2026-112902 · GHSA-XVH5-G6GV-559V |
pillowExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Pillow: Image.quantize() with empty palette leaks uninitialized stack memoryCVE-2026-112898 · GHSA-RFGQ-Q3W2-PMV2 |
pillowExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()CVE-2026-112401 · GHSA-74R2-7FF9-MJJ2 |
pillowExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Pillow: Quadratic GIF comment copying during saveCVE-2026-112891 · GHSA-FC9G-5QG7-MF45 |
pillowExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Pillow: Argument Injection in Ghostscript call, potentially leading into RCECVE-2026-112900 · GHSA-W889-685W-C8FH |
pillowExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Critical
|
Fix reported |
|
| Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limitCVE-2026-112899 · GHSA-VX6W-VV9F-6GVG |
pillowExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)CVE-2026-112395 · GHSA-462X-PGG6-55FP |
pillowExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Pillow has a heap buffer overflow with nested list coordinatesCVE-2026-42309 · GHSA-5XMW-VC9V-4WF2Version ranges need review. |
pillowExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)CVE-2026-54058 · GHSA-62P4-GMF7-7G93Version ranges need review. |
pillowExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Pillow has an integer overflow when processing fontsCVE-2026-42308 · GHSA-WJX4-4JCJ-G98JVersion ranges need review. |
pillowExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
