CVE Tools
Track your stack

Pillow

116 CVEs tracked. 1 of them are in CISA KEV.

This hub aggregates every CVE we track for Pillow, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Pillow CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Pillow CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-071
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-021
2026-030
2026-041
2026-054
2026-060
2026-0713
2026-080
2026-090
2026-1039
2026-112

Severity

How the 116 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical1816%
  • High5851%
  • Medium3732%
  • Low11%

Latest CVEs

The 15 most recently published vulnerabilities affecting Pillow.

  1. CVE-2026-112902Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags9.1
  2. CVE-2026-112899Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit5.3
  3. GHSA-78g4-xqwv-q3g8Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()—
  4. CVE-2026-114501Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 15.3
  5. CVE-2026-96639Pillow multi-frame loaders can reuse stale native image storage after mode transitions9.8
  6. CVE-2026-96636Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)6.5
  7. CVE-2026-96640Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion7.5
  8. CVE-2026-96637Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS6.5
  9. CVE-2026-96778Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer8.8
  10. CVE-2026-96643Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time6.5
  11. CVE-2026-96644Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)8.1
  12. CVE-2026-96641Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise6.5
  13. CVE-2026-96642Pillow: TarIO negative size field causes infinite CPU-spin loop6.5
  14. CVE-2026-96638Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode6.5
  15. CVE-2026-112901Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes7.5

Product grouping is registry-driven, with AI assist and human review. How it works