Pillow
76 CVEs tracked. 1 of them are in CISA KEV.
This hub aggregates every CVE we track for Pillow, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Pillow CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 1 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 1 |
| 2026-03 | 0 |
| 2026-04 | 1 |
| 2026-05 | 4 |
| 2026-06 | 0 |
| 2026-07 | 13 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 76 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical12
- High36
- Medium25
- Low1
Latest CVEs
The 15 most recently published vulnerabilities affecting Pillow.
- CVE-2026-54058Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)9.1
- CVE-2026-59197Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`8.2
- CVE-2026-59200Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()7.5
- CVE-2026-59198Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images6.5
- CVE-2026-59205Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch7.5
- CVE-2026-59203Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service5.3
- CVE-2026-59199Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow7.5
- CVE-2026-59204Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service7.5
- CVE-2026-55379Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading7.5
- CVE-2026-55380Pillow GdImageFile decompression bomb protection bypass7.5
- CVE-2026-54060Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`7.5
- CVE-2026-54059Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading7.5
- CVE-2026-55798Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path4.5
- CVE-2026-42311Pillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow)7.8
- CVE-2026-42310Pillow: PDF Parsing Trailer Infinite Loop (DoS)5.5
Product grouping is registry-driven, with AI assist and human review. How it works