CVE-2016-9189: Pillow Integer Overflow Vulnerability
Summary
CVE-2016-9189: Pillow Integer overflow in Map.c. Affects pillow versions < 3.3.2. Fixed in 3.3.2. How to fix ↓
Also tracked for
- pillow · Debian:11
The same CVE-2016-9189 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python imaging library that provides support for opening, manipulating, and saving many different image file formats. It is widely used in various applications for image processing and manipulation. However, versions of Pillow before 3.3.2 are vulnerable to an Integer Overflow issue in the Image.core.map_buffer component of the library. This vulnerability can be exploited by context-dependent attackers using a crafted image file. The vulnerability has a CVSS score of 5.5, indicating a moderate severity.
Vulnerability Detail
The Integer Overflow vulnerability in Pillow arises from a flaw in the Image.core.map_buffer function in the map.c component. By exploiting this vulnerability, an attacker can obtain sensitive information from the targeted system. The vulnerability can be triggered by using a specially crafted image file. The issue is context-dependent, meaning that the impact and severity of the vulnerability may vary depending on the specific usage scenario. It is important to note that versions of Pillow before 3.3.2 are affected by this vulnerability.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.2
This is the first release that contains the fix.
pip install --upgrade "pillow==3.3.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended approach is to update Pillow to the latest version as mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, the Pillow Integer Overflow vulnerability (CVE-2016-9189) affects versions of Pillow before 3.3.2. It allows context-dependent attackers to obtain sensitive information by using a crafted image file. To mitigate this vulnerability, it is crucial to update Pillow to version 3.3.2 or later. Additionally, it is recommended to keep all applications and systems using Pillow up to date. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for pillow →
FAQ
The vulnerability allows attackers to obtain sensitive information from the targeted system. The impact may vary depending on the specific usage scenario.
Versions of Pillow before 3.3.2 are affected by this vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Pipfile.lock and the tool will provide real-time alerts for open-source vulnerabilities.
Yes, the CVSS score for this vulnerability is 5.5, indicating a moderate severity.
For more information, you can refer to the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-rwr3-c2q8-gm56/GHSA-rwr3-c2q8-gm56.json
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
