CVE-2016-4009: Integer overflow vulnerability in Pillow
Summary
CVE-2016-4009: Pillow Integer overflow in ImagingResampleHorizontal. Affects pillow versions < 3.1.1. Fixed in 3.1.1. How to fix ↓
Also tracked for
- pillow · Debian:11
The same CVE-2016-4009 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python imaging library that provides support for opening, manipulating, and saving many different image file formats. It is widely used in various applications and frameworks for image processing and manipulation. However, versions of Pillow prior to 3.1.1 are affected by an integer overflow vulnerability in the ImagingResampleHorizontal function in libImaging/Resample.c. This vulnerability can be exploited by remote attackers through negative values of the new size, leading to a heap-based buffer overflow.
Vulnerability Detail
The integer overflow vulnerability in Pillow arises from a flaw in the ImagingResampleHorizontal function. By providing negative values for the new size, an attacker can trigger a heap-based buffer overflow. This can potentially result in arbitrary code execution or denial of service. The impact of this vulnerability is unspecified, but it is considered critical due to the potential for remote exploitation. The vulnerability is assigned the CVE identifier CVE-2016-4009 and has a CVSS v3 score of 9.8, indicating its severity.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.1
This is the first release that contains the fix.
pip install --upgrade "pillow==3.1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to a patched version of Pillow to mitigate the risk.
Conclusion
The integer overflow vulnerability in Pillow can be exploited by remote attackers to trigger a heap-based buffer overflow. To mitigate this risk, it is crucial to update Pillow to version 3.1.1 or later. This will ensure that the vulnerability is patched and the application is protected. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a Python imaging library that provides support for opening, manipulating, and saving various image file formats.
The impact of this vulnerability is unspecified, but it has the potential for remote code execution or denial of service.
To fix this vulnerability, update Pillow to version 3.1.1 or later by running 'pip install --upgrade pillow'.
No, there is no known workaround. Updating to a patched version is the recommended solution.
The CVSS v3 score of this vulnerability is 9.8, indicating its critical severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
