PI
Product
Pillow
58
CVEs
0
On KEV
9.8
Max CVSS
38
New 30D
Severity mix
Critical 6High 38Medium 14Low 0
Watch
Add Pillow to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-112897 | 6.2 | Oct 19 | Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips Affected: >= 5.3.0, < 13.0.0 |
| CVE-2026-42310 | 5.5 | May 9 | Pillow: PDF Parsing Trailer Infinite Loop (DoS) Affected: >= 4.2.0, < 12.2.0 |
| CVE-2026-42308 | 5.5 | May 9 | Pillow: Integer overflow when processing fonts Affected: < 12.2.0 |
| CVE-2026-42309 | 5.5 | May 9 | Pillow: Heap buffer overflow with nested list coordinates Affected: >= 11.2.1, < 12.2.0 |
| CVE-2025-48379 | 5.5 | Jul 1 | Pillow Vulnerable to Write Buffer Overflow on BCn encoding Affected: >= 11.2.0, < 11.3.0 |
| CVE-2026-114501 | 5.3 | Oct 21 | Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1 Affected: >= 11.2.1, < 13.0.0 |
| CVE-2026-112898 | 5.3 | Oct 19 | Pillow: Image.quantize() with empty palette leaks uninitialized stack memory Affected: >= 9.1.0, < 13.0.0 |
| CVE-2026-55798 | 4.5 | Jul 6 | Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path Affected: < 12.3.0 |