CVE-2026-54058

Pillow (Python imaging library) contains CVE-2026-54058, affecting the mmap raw codec path when loading uncompressed McIdas AREA images. Attacker-controlled header words can set a row stride smaller than the natural row width, enabling reads beyond the mapped region and potentially disclosing adj...

CVE-2026-40192

Pillow (Python imaging library) versions 10.3.0–12.1.1 are affected by a FITS-related decompression bomb: unbounded memory consumption from GZIP data during decoding, potentially leading to DoS. A fix is available in Pillow 12.2.0; if upgrading isn’t possible, users should avoid opening FITS imag...

CVE-2026-25990

CVE-2026-25990 : Pillow (Python Imaging Library) contains an out-of-bounds write when loading a specially crafted PSD image. Affected versions are 10.3.0 up to before 12.1.1; the issue is fixed in 12.1.1. The provided documents do not specify exploit status or in-the-wild details beyond this fix.

CVE-2026-54059

Pillow (Python imaging library) contains CVE-2026-54059. The vulnerability affects PcfFontFile._load_bitmaps(), which reads glyph dimensions from the PCF METRICS section and passes them to Image.frombytes() without calling Image._decompression_bomb_check(). This can lead to excessive memory alloc...

CVE-2026-42308

Pillow CVE-2026-42308 describes an integer overflow in font handling that occurs when a glyph advances by an excessively large amount. Affected is Pillow before version 12.2.0; the issue is resolved in 12.2.0. The CVSS vector indicates local, low complexity access with no privileges required and ...

CVE-2026-55379

Pillow (Python imaging library) is affected by CVE-2026-55379. In older releases, PIL/BdfFontFile.py:bdf_char() read BBX width/height from a BDF font and passed attacker-controlled values to Image.new() without invoking Image._decompression_bomb_check(), bypassing the library’s decompression bomb...

CVE-2026-59197

Pillow (Python Imaging Library) contains a heap out-of-bounds write in the public rank-filter API prior to version 12.3.0. The flaw occurs when an extremely large odd filter size is used, because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size vali...

CVE-2026-42310

CVE-2026-42310 affects the Pillow Python imaging library. The vulnerability lies in the PdfParser logic: Pdf trailers’ Prev pointers can reference already-processed offsets, creating a cycle that causes an infinite loop and 100% CPU usage, potentially hanging the process. Affected versions are Pi...

CVE-2026-59198

CVE-2026-59198 affects Pillow, the Python imaging library. The issue lies in Pillow’s TGA RLE encoder, which from 5.2.0 up to 12.3.0 reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file....

CVE-2026-59199

Pillow (Python imaging library) prior to 12.3.0 is affected by a heap out-of-bounds write in public image coordinate APIs when coordinates near signed 32-bit limits are provided to Image.paste(), Image.crop(), or Image.alpha_composite(). The issue is fixed in 12.3.0. Affected component: Pillow’s ...

CVE-2026-55798

Pillow vulnerability CVE-2026-55798 affects WindowsViewer.get_command() in Pillow prior to 12.3.0. It builds a shell command by unescaped file path injected into an f-string and passes it to subprocess.Popen(..., shell=True), enabling injection of arbitrary cmd.exe commands. Impact is limited to ...

CVE-2026-55380

Pillow (Python imaging library) vulnerability: Prior to 12.3.0, in GdImageFile._open(), image dimensions were read from the GD 2.x header and stored in self._size without invoking Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation. Impact: potent...

CVE-2026-54060

The issue affects Pillow (Python imaging library). In FontFile.compile(), per-glyph images were assembled into a single bitmap using Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), enabling an attacker to trigger excessive memory allocation during conversion or s...

CVE-2026-42311

CVE-2026-42311 affects the Pillow Python imaging library. From version 10.3.0 up to, but not including, 12.2.0, processing a malicious PSD file can trigger an out-of-bounds/invalid PSD tile extents write, leading to memory corruption with potential crash or arbitrary code execution. The issue has...

CVE-2026-59200

Summary: Pillow 5.1.0–12.3.0 contains a memory exhaustion vulnerability in PdfParser.PdfStream.decode() caused by calling zlib.decompress() with an unbounded output size (bufsize set to the PDF stream Length). This can allow a crafted FlateDecode PDF stream to exhaust memory on a small file. Affe...

CVE-2026-59203

Pillow (Python imaging library) 12.0.0–12.2.0 is affected by an issue in the EPS parser (PIL/EpsImagePlugin.py) where a negative byte count in the %%BeginBinary directive allows an EPS file to cause Image.open() to seek backwards to the same directive and repeatedly parse it, creating an infinite...

CVE-2026-42309

CVE-2026-42309 affects the Pillow Python imaging library. From 11.2.1 up to 11.2.x before 12.2.0, passing nested lists as coordinates to APIs like ImagePath.Path, ImageDraw.ImageDraw.polygon, and ImageDraw.ImageDraw.line could cause a heap-based buffer overflow because nested coordinates were rec...

CVE-2026-59204

Affected software: Pillow (Python imaging library). Vulnerability details: In Pillow versions 8.2.0–12.2.0, the decoder path in src/libImaging/Jpeg2KDecode.c aggregates total_component_width across every tile of a JPEG2000 image instead of recomputing per tile. This can cause a crafted tiled JPEG...

CVE-2026-59205

Pillow (Python imaging library) contains a vulnerability in ImageCmsTransform.apply(im, imOut): before version 12.3.0, supplying an output image whose mode does not match the transform’s declared output mode can trigger a controlled native heap corruption. Affected component is ImageCmsTransform....