CVE-2020-5313: Out-of-bounds Read in Pillow
Summary
CVE-2020-5313: Out-of-bounds Read in Pillow. Affects pillow versions < 6.2.2. Fixed in 6.2.2. How to fix ↓
Also tracked for
- pillow · Bitnami
- py3-pillow · Alpine:v3.12
The same CVE-2020-5313 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python library for image processing and manipulation. It provides a wide range of functionality for opening, manipulating, and saving many different image file formats. The library is widely used in various applications and frameworks for image-related tasks. However, versions prior to 6.2.2 of Pillow are vulnerable to an out-of-bounds read issue in the FLI decoding functionality.
Vulnerability Detail
The vulnerability (CVE-2020-5313) originates from a buffer overflow in the FLI decoding module of Pillow. This flaw allows an attacker to read data beyond the boundaries of the allocated buffer, potentially leading to information disclosure or a crash. The issue has a CVSS score of 7.1, indicating a high severity level. It can be exploited by an attacker with network access to a vulnerable system, but without requiring any privileges. The vulnerability was discovered and reported by the GitHub Security Lab.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.2.2
This is the first release that contains the fix.
pip install --upgrade "pillow==6.2.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of Pillow to ensure the security of the application.
Conclusion
In conclusion, the vulnerability (CVE-2020-5313) in Pillow poses a high risk to applications utilizing the library for image processing. It is crucial to update to the fixed version (6.2.2 or later) to mitigate the risk of information disclosure or crashes. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
The vulnerability allows an attacker to read data beyond the allocated buffer, potentially leading to information disclosure or a crash. It can be exploited remotely without requiring any privileges.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes your Pipfile.lock file and provides real-time alerts for open-source vulnerabilities.
There are no known public exploits for this vulnerability at the time of this report. However, it is always recommended to update to the latest version to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely by an attacker with network access to a vulnerable system.
Yes, the vulnerability can be fixed by upgrading Pillow to version 6.2.2 or later.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
