CVE Tools
Track your stack

Python-pillow

51 CVEs tracked since 2026. Since Jul 2026, none of them reached CISA KEV.

Python-pillow CVEs per month

Jul 2026 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Python-pillow CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-07130
2026-088 or fewer
2026-099 or fewer
2026-10380
2026-113 or fewer

Products

The products that kept showing up in Python-pillow's monthly top three, with their CVEs summed over those months.

  1. Pillow512 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Python-pillow.

  1. CVE-2026-112902Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags9.1
  2. CVE-2026-112899Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit5.3
  3. CVE-2026-114501Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 15.3
  4. CVE-2026-96639Pillow multi-frame loaders can reuse stale native image storage after mode transitions9.8
  5. CVE-2026-96636Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)6.5
  6. CVE-2026-96640Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion7.5
  7. CVE-2026-96637Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS6.5
  8. CVE-2026-96778Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer8.8
  9. CVE-2026-96643Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time6.5
  10. CVE-2026-96644Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)8.1
  11. CVE-2026-96641Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise6.5
  12. CVE-2026-96642Pillow: TarIO negative size field causes infinite CPU-spin loop6.5
  13. CVE-2026-96638Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode6.5
  14. CVE-2026-112901Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes7.5
  15. CVE-2026-112900Pillow: Argument Injection in Ghostscript call, potentially leading into RCE9.8

The record

Peak rank
#47 in Oct 2026
Busiest month shown
Oct 2026, 38 CVEs
Months with a KEV entry
0 since Jul 2026
Monthly snapshots
2 since 2026
Python-pillow's full record, month by month