CVE-2021-25291: Out of Bounds Read in Pillow
Summary
CVE-2021-25291: Out of bounds read in Pillow. Affects pillow versions < 8.2.0. Fixed in 8.2.0. How to fix ↓
Also tracked for
- pillow · Bitnami
- py3-pillow · Alpine:v3.14
The same CVE-2021-25291 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python imaging library that provides support for opening, manipulating, and saving many different image file formats. It is widely used in various applications for image processing and manipulation. However, an out-of-bounds read vulnerability has been discovered in Pillow versions before 8.1.1. This vulnerability, identified as CVE-2021-25291, specifically affects the TiffDecode.c module in Pillow. The issue arises from an invalid tile boundary in the TiffreadRGBATile function, leading to an out-of-bounds read operation.
Vulnerability Detail
The out-of-bounds read vulnerability in Pillow can be exploited by an attacker to read data beyond the boundaries of a valid tile. This could potentially result in the disclosure of sensitive information or the execution of arbitrary code. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity level. The CWE-125 category is associated with this vulnerability, which refers to out-of-bounds read issues. The vulnerability was discovered on March 29, 2021, and it was reviewed by GitHub on March 22, 2021.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.2.0
This is the first release that contains the fix.
pip install --upgrade "pillow==8.2.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if upgrading to the latest version of Pillow is not immediately feasible, developers can consider implementing input validation and sanitization techniques to prevent malicious inputs from triggering the out-of-bounds read vulnerability. Additionally, restricting access to the affected functionality or implementing proper access controls can help mitigate the risk associated with this vulnerability.
Conclusion
In conclusion, the out-of-bounds read vulnerability in Pillow versions before 8.1.1 poses a significant risk to applications utilizing this library for image processing. It is crucial to upgrade to the latest version of Pillow (8.2.0 or later) to mitigate this vulnerability. Developers should also consider implementing input validation and access controls as temporary workarounds. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a Python imaging library that provides support for opening, manipulating, and saving various image file formats.
The vulnerability allows an attacker to read data beyond the boundaries of a valid tile, potentially leading to information disclosure or arbitrary code execution.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade Pillow to version 8.2.0 or later.
As a workaround, developers can implement input validation and sanitization techniques or restrict access to the affected functionality.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
