CVE-2024-28219: Pillow Buffer Overflow Vulnerability
Summary
CVE-2024-28219: Pillow buffer overflow vulnerability. Affects pillow versions < 10.3.0. Fixed in 10.3.0. How to fix ↓
Also tracked for
The same CVE-2024-28219 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a widely used Python Imaging Library that adds image processing capabilities to your Python interpreter. It supports opening, manipulating, and saving many different image file formats. The library is essential for developers who require image handling in their applications. However, a critical vulnerability has been identified in versions prior to 10.3.0, which could lead to severe security risks.
Vulnerability Detail
In the Pillow library, specifically in the _imagingcms.c file, a buffer overflow vulnerability exists due to the improper use of the strcpy function instead of the safer strncpy function. This flaw can potentially allow an attacker to execute arbitrary code, leading to data corruption, crashes, or unauthorized access to sensitive information. The vulnerability is particularly concerning as it affects a core component of the library, making it a significant risk for applications that rely on Pillow for image processing.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.3.0
This is the first release that contains the fix.
pip install --upgrade "pillow==10.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if you cannot update the Pillow package immediately, consider implementing input validation to ensure that image data does not exceed expected limits. However, this is not a complete solution and should not replace updating the package.
Conclusion
The buffer overflow vulnerability in the Pillow library poses a significant risk to applications that utilize this image processing tool. It is essential to update to version 10.3.0 or later to mitigate this risk. Regular monitoring for vulnerabilities, such as through Vulert, can help maintain the security of your software.
See every vulnerability recorded for pillow →
FAQ
A buffer overflow vulnerability occurs when a program writes more data to a buffer than it can hold, potentially allowing attackers to overwrite adjacent memory and execute arbitrary code.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences can include data corruption, application crashes, and unauthorized access to sensitive information, which can lead to significant security breaches.
Yes, the CVSS score for this vulnerability is 6.7, indicating a medium severity level that requires prompt attention.
If an immediate update is not possible, implement input validation as a temporary workaround, but prioritize updating to the patched version as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
