CVE-2016-2533: Buffer Overflow in Pillow
Summary
CVE-2016-2533: Pillow buffer overflow in ImagingPcdDecode. Affects pillow versions < 3.1.1. Fixed in 3.1.1. How to fix ↓
Also tracked for
- pillow · Debian:11
The same CVE-2016-2533 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is an open-source Python library that provides support for opening, manipulating, and saving many different image file formats. It is widely used in various applications for image processing and manipulation. However, versions of Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier are vulnerable to a buffer overflow in the ImagingPcdDecode function in PcdDecode.c. This vulnerability can be exploited by remote attackers through a crafted PhotoCD file, leading to a denial of service (crash) of the application.
Vulnerability Detail
The vulnerability in Pillow and PIL arises from a buffer overflow in the ImagingPcdDecode function. By exploiting this vulnerability, remote attackers can cause a denial of service by crashing the application. The buffer overflow occurs when processing a specially crafted PhotoCD file, allowing the attacker to overwrite adjacent memory and disrupt the normal execution of the program. This can potentially lead to arbitrary code execution or other security issues.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.1
This is the first release that contains the fix.
pip install --upgrade "pillow==3.1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to a fixed version of Pillow or Python Imaging Library to mitigate the risk.
Conclusion
The buffer overflow vulnerability in Pillow and Python Imaging Library can be exploited by remote attackers to crash the application. It is crucial to update to a fixed version of Pillow (3.1.1 or later) or Python Imaging Library to mitigate the risk. Regularly updating all dependencies and libraries used in the application is also recommended to ensure the latest security patches are applied. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
The vulnerability allows remote attackers to crash the application, resulting in a denial of service. It may also have the potential for arbitrary code execution or other security issues.
Versions of Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier are vulnerable to this issue.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
While there are no known public exploits for this specific vulnerability, it is still crucial to update to the fixed version to prevent potential attacks.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide assistance and guidance in addressing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
