ROOT-APP-PYPI-CVE-2026-55380 CVE-2026-55380 in pillow - Patched by Root

Root has patched CVE-2026-55380 in the pillow package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-56PW-MPJ4-FXWW GHSA-56pw-mpj4-fxww in pillow - Patched by Root

Root has patched GHSA-56pw-mpj4-fxww in the pillow package for Root:PyPI. Multiple fixed versions available...

Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image

A flaw was found in Pillow prior to 12.3.0. When an uncompressed McIdas AREA image is loaded from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width. Pixel access such as Image.tobytes, getpixel, convert, or save ca...

EulerOS 2.0 SP11 : python-pillow (EulerOS-SA-2026-3147)

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the...

EulerOS 2.0 SP15 : python-pillow (EulerOS-SA-2026-2902)

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.6 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

python-pillow: Pillow: Denial of Service via crafted PCF font data

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primar...

python-pillow: Pillow: Denial of Service via crafted PCF font data

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primar...

Security Bulletin:Pillow Integer Overflow Vulnerability Fixed in Version 12.2.0

Summary Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0. Vulnerability Details...

RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2026:50319)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:50319 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

Important: Red Hat Security Advisory: python-pillow security update

An update for python-pillow is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scori...

The vulnerability of the Pillow image processing library, related to the execution of a loop with an unreachable exit condition, allows a intruder to cause a service failure.

The vulnerability of the Pillow image processing library lies in the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow an attacker to cause a service failure...

RockyLinux 8 : python-pillow (RLSA-2026:48021)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:48021 advisory. Pillow: Pillow: Native heap out-of-bounds write CVE-2026-59197 Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image...

RHEL 8 : python-pillow (RHSA-2026:48759)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:48759 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image

A flaw was found in Pillow prior to 12.3.0. When an uncompressed McIdas AREA image is loaded from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width. Pixel access such as Image.tobytes, getpixel, convert, or save ca...

CVE-2026-59205

creationtimestamp| type| source ---|---|--- 2026-07-21 00:35:08+00:00| published-proof-of-concept| https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6 2026-07-21 06:31:17+00:00| seen| https://gist.github.com/alon710/c194376028b5fea9d1333b8a7894f724...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2751)

According to the versions of the package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the...

GHSA-8V84-F9PQ-WR9X Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

Description PIL/PcfFontFile.py loadbitmaps line 227 reads glyph dimensions from the PCF METRICS section and passes them directly to Image.frombytes without calling Image.decompressionbombcheck. Dimensions originate from unsigned 16-bit values: xsize = right - left max: 65535 − 0 = 65535 ysize =...

The vulnerability of the PyImaging_MapBuffer() function in the src/map.c component of the Pillow image processing library allows a attacker to disclose protected information or cause service interruptions.

The vulnerability of the PyImagingMapBuffer function in the src/map.c component of the Pillow image processing library is related to the issue of the operation exceeding the buffer’s boundaries. Exploiting this vulnerability could allow an attacker to disclose sensitive information or cause servi...

SUSE-SU-2026:3084-1 Security update for python-Pillow

This update for python-Pillow fixes the following issues - CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on mmap path bsc1271419. - CVE-2026-59197: heap out-of-bounds write in ImageFilter.RankFilter via integer overflow in ImagingExpand bsc1271418. - CVE-2026-59198:...