Summary
It was discovered that Pillow could enter an infinite loop while
determining the frame count of a MIC image. An attacker could
possibly use this issue to cause a denial of service. This issue
only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, and
Ubuntu 22.04 LTS. (CVE-2026-112390)
It was discovered that Pillow's PdfParser.get_value() could recurse
without a limit while reading nested PDF objects. An attacker could
possibly use this issue to cause a denial of service. This issue
only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS,
Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS.
(CVE-2026-112391)
It was discovered that Pillow's rank-based filters could dereference
invalid image storage for a zero-size image. An attacker could
possibly use this issue to cause a crash. (CVE-2026-112392)
It was discovered that Pillow had a heap buffer overflow in
_tiffWriteProc when saving compressed TIFF data. An attacker could
possibly use this issue to crash the process or execute arbitrary
code. (CVE-2026-112393)
It was discovered that Pillow's P;2L and P;4L raw decoders could
read past the end of an input buffer. An attacker could possibly
use this issue to disclose heap memory or crash the process.
(CVE-2026-112394)
It was discovered that Pillow's tiled-TIFF decoder could read past
the tile buffer while copying four-byte pixels. An attacker could
possibly use this issue to expose heap data or crash the process.
This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu
24.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-112395)
It was discovered that Pillow had a heap use-after-free when libtiff
rejects a tag while encoding TIFF data to an in-memory buffer. An
attacker could possibly use this issue to crash the process or
execute arbitrary code. This issue only affected Ubuntu 26.10 and
Ubuntu 26.04 LTS. (CVE-2026-112396)
It was discovered that Pillow's ImageMorph.MorphOp.apply() could
access memory before a row buffer for a zero-width image. An
attacker could possibly use this issue to cause a crash.
(CVE-2026-112397)
It was discovered that Pillow's FlashPix JPEG-tile decoder could
write decoded scanlines beyond the allocated tile buffer. An
attacker could possibly use this issue to corrupt heap memory and
execute arbitrary code. (CVE-2026-112398)
It was discovered that Pillow could allocate an APNG disposal
background at the full canvas size before applying the
decompression-bomb check. An attacker could possibly use this
issue to exhaust memory and cause a denial of service. This issue
only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS,
and Ubuntu 22.04 LTS. (CVE-2026-112399)
It was discovered that Pillow could retain a rejected GIF frame
size after a decompression-bomb exception. An attacker could
possibly use this issue to exhaust memory and cause a denial of
service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS,
and Ubuntu 24.04 LTS. (CVE-2026-112400)
It was discovered that Pillow performed quadratic copying while
parsing GIF comments. An attacker could possibly use this issue
to cause a denial of service. This issue only affected Ubuntu
26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, and
Ubuntu 20.04 LTS. (CVE-2026-112401)
It was discovered that Pillow could double free image memory when
ImagingScaleAffine encounters a selective allocation failure. An
attacker could possibly use this issue to crash the process.
(CVE-2026-112402)
It was discovered that Pillow's JPEG decoder could write a
full-width scanline into a buffer sized for a requested draft
scale. An attacker could possibly use this issue to corrupt heap
memory or execute arbitrary code. (CVE-2026-112403)
It was discovered that Pillow's TIFF tile and RGBA decode paths
could read beyond row data produced by libtiff. An attacker could
possibly use this issue to expose heap data or crash the process.
This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu
24.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-112404)
It was discovered that Pillow's Image.merge() could dereference a
null image8 plane. An attacker could possibly use this issue to
cause a crash. This issue only affected Ubuntu 26.10 and Ubuntu
26.04 LTS. (CVE-2026-112405)
It was discovered that Pillow could enter an infinite loop while
rewriting PDF pages. An attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 26.10,
Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04
LTS, and Ubuntu 18.04 LTS. (CVE-2026-112406)
It was discovered that Pillow performed quadratic copying when
saving a GIF with a long comment. An attacker could possibly use
this issue to cause a denial of service. This issue only affected
Ubuntu 26.10, Ubuntu 26.04 LTS, and Ubuntu 24.04 LTS.
(CVE-2026-112891)
It was discovered that Pillow's MSP RLE decoder could expand a
small file into an unbounded in-memory buffer. An attacker could
possibly use this issue to exhaust memory and cause a denial of
service. This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS,
Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, and Ubuntu
18.04 LTS. (CVE-2026-112892)
It was discovered that Pillow could free an invalid glyph pointer
during FreeType rendering with an active stroker. An attacker could
possibly use this issue to corrupt memory or crash the process.
This issue only affected Ubuntu 26.10, Ubuntu 26.04 LTS, and
Ubuntu 24.04 LTS. (CVE-2026-112893)
It was discovered that Pillow took quadratic time to reserve PDF
object identifiers when saving many frames. An attacker could
possibly use this issue to cause a denial of service. This issue
only affected Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS,
Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS.
(CVE-2026-112894)
It was discovered that Pillow could exhaust resources while parsing
an existing PDF during an append operation. An attacker could
possibly use this issue to cause a denial of service. This issue
only affe
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | pillow | 9.0.1-1ubuntu0.7 |
| Ubuntu · 24.04 LTS 24.04:LTS | pillow | 10.2.0-1ubuntu1.5 |
| Ubuntu · 26.04 LTS 26.04:LTS | pillow | 12.1.1-2ubuntu1.5 |
| Ubuntu · 26.10 | pillow | 12.3.0-1ubuntu2 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | pillow | 2.3.0-1ubuntu3.4+esm6 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | pillow | 3.1.2-0ubuntu1.6+esm4 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | pillow | 5.1.0-1ubuntu0.8+esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | pillow | 7.0.0-4ubuntu0.9+esm2 |
Vulnerabilities 39
-
Critical 9.8
Pillow multi-frame loaders can reuse stale native image storage after mode transitions
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK d…
-
Critical 9.2
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback si…
-
Critical 9.2CVE-2026-112398 Public exploit
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode c…
-
Critical 9.2CVE-2026-112403 Public exploit
Pillow: Heap buffer overflow in ImagingJpegDecode
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is re…
-
Critical 9.2CVE-2026-112900 Public exploit
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe abso…
-
High 8.8
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretati…
-
High 8.8
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap t…
-
High 8.7
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[widt…
-
High 8.7
Pillow: APNG background disposal allocates full canvas before decompression bomb check
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and backg…
-
High 8.7
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an …
-
High 8.7
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations…
-
High 8.7
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narr…
-
High 8.7
Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to…
-
High 8.7
Pillow: MSP RLE decoder expands a tiny file into unbounded memory
Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacke…
-
High 8.7
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifi…
-
High 8.7
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer…
-
High 8.7
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the byt…
-
High 8.2
Pillow: Infinite loop in MIC n_frames when the embedded TIFF
Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() rese…
-
High 8.2
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from …
-
High 8.2
Pillow: Invalid free in FreeType glyph rendering when a stroker is active
Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An att…
-
High 8.2
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", append=True) processes …
-
High 7.7CVE-2026-96778 Public exploit
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte b…
-
High 7.1
Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame…
-
High 7.1
Pillow: TarIO negative size field causes infinite CPU-spin loop
Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parse…
-
High 7.1
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file fill…
-
Medium 6.9
Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()
Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile._seek() repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed…
-
Medium 6.9
Pillow: Quadratic GIF comment copying during save
Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. _get_global_header() repeatedly copies portions of comment data while assembling the global header, including comments retain…
-
Medium 6.9
Pillow: Image.quantize() with empty palette leaks uninitialized stack memory
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, an…
-
Medium 6.9
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile._open, when an application calls Image.open() on a small crafted XBM file, XbmImagePlugin applies a backtrac…
-
Medium 6.5
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the …
-
Medium 6.5
Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DCX frames and replace self._size without rerunning Image._decompression_bomb_check(). A crafted multi-frame image can use a tiny first frame…
-
Medium 6.5
Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining dest_length without a per-branch cap. A delta can add …
-
Medium 6.5
Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/_imaging.c checks positive glyph advances against INT_MAX but does not check negative advances against INT_MIN. Repeating a signed 16-bit advance of -32768 can therefo…
-
Medium 6.3
Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append.…
-
Medium 6.3
Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can read past the end of an input buffer. ImagingRawDecode calculates a packed-pixel row size, while the unpackers read separately padded bit planes. A caller can supply …
-
Medium 6.3
Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLOW_ALIGNMENT makes aligned_linesize include row padding or an aligned offset before…
-
Medium 5.9
Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a…
-
Medium 5.1
Pillow: Integer overflow when processing fonts
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.
-
Medium 5.1
Pillow: PDF Parsing Trailer Infinite Loop (DoS)
Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in ve…
References
-
report
https://ubuntu.com/security/CVE-2026-42308
-
report
https://ubuntu.com/security/CVE-2026-42310
-
report
https://ubuntu.com/security/CVE-2026-96636
-
report
https://ubuntu.com/security/CVE-2026-96637
-
report
https://ubuntu.com/security/CVE-2026-96638
-
report
https://ubuntu.com/security/CVE-2026-96639
-
report
https://ubuntu.com/security/CVE-2026-96640
-
report
https://ubuntu.com/security/CVE-2026-96641
-
report
https://ubuntu.com/security/CVE-2026-96642
-
report
https://ubuntu.com/security/CVE-2026-96643
-
report
https://ubuntu.com/security/CVE-2026-96778
-
report
https://ubuntu.com/security/CVE-2026-112390
-
report
https://ubuntu.com/security/CVE-2026-112391
-
report
https://ubuntu.com/security/CVE-2026-112392
-
report
https://ubuntu.com/security/CVE-2026-112393
-
report
https://ubuntu.com/security/CVE-2026-112394
-
report
https://ubuntu.com/security/CVE-2026-112395
-
report
https://ubuntu.com/security/CVE-2026-112396
-
report
https://ubuntu.com/security/CVE-2026-112397
-
report
https://ubuntu.com/security/CVE-2026-112398
-
report
https://ubuntu.com/security/CVE-2026-112399
-
report
https://ubuntu.com/security/CVE-2026-112400
-
report
https://ubuntu.com/security/CVE-2026-112401
-
report
https://ubuntu.com/security/CVE-2026-112402
-
report
https://ubuntu.com/security/CVE-2026-112403
-
report
https://ubuntu.com/security/CVE-2026-112404
-
report
https://ubuntu.com/security/CVE-2026-112405
-
report
https://ubuntu.com/security/CVE-2026-112406
-
report
https://ubuntu.com/security/CVE-2026-112891
-
report
https://ubuntu.com/security/CVE-2026-112892
-
report
https://ubuntu.com/security/CVE-2026-112893
-
report
https://ubuntu.com/security/CVE-2026-112894
-
report
https://ubuntu.com/security/CVE-2026-112895
-
report
https://ubuntu.com/security/CVE-2026-112896
-
report
https://ubuntu.com/security/CVE-2026-112897
-
report
https://ubuntu.com/security/CVE-2026-112898
-
report
https://ubuntu.com/security/CVE-2026-112900
-
report
https://ubuntu.com/security/CVE-2026-112901
-
report
https://ubuntu.com/security/CVE-2026-114501