Python-Pillow · weakness class
Memory Corruption
30 CVEs
Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 30 is a mark on the map. Named now: 1 to 26, most at risk first.
- Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
- Pillow: Heap buffer overflow in ImagingJpegDecode
- Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
- Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
- Pillow multi-frame loaders can reuse stale native image storage after mode transitions
- Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
- Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
- Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
- Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
- Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
- Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
- Pillow: Invalid free in FreeType glyph rendering when a stroker is active
- Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
- Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
- Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
- Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
- Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
- Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size
- Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
- Pillow has an out-of-bounds write when loading PSD images
- Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch
- Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
- Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
- Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
- Pillow: Image.quantize() with empty palette leaks uninitialized stack memory
- Pillow Vulnerable to Write Buffer Overflow on BCn encoding
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.