CVE-2020-35654: Out-of-bounds Write in Pillow
Summary
CVE-2020-35654: Pillow Out-of-bounds Write. Affects pillow versions < 8.1.0. Fixed in 8.1.0. How to fix ↓
Also tracked for
- pillow · Bitnami
- py3-pillow · Alpine:v3.14
The same CVE-2020-35654 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python library for image processing and manipulation. It provides a wide range of functionality for working with various image formats. However, versions of Pillow before 8.1.0 are vulnerable to an out-of-bounds write issue in the TiffDecode component. This vulnerability arises due to conflicts with LibTIFF when decoding certain crafted YCbCr files in RGBA mode.
Vulnerability Detail
The out-of-bounds write vulnerability in Pillow can be exploited by an attacker to overwrite heap-based memory beyond its intended boundaries. This can lead to arbitrary code execution or a denial of service condition. The issue originates from the incorrect interpretation of crafted YCbCr files in RGBA mode, which triggers the buffer overflow. The vulnerability has a high severity rating with a CVSS score of 8.8.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.1.0
This is the first release that contains the fix.
pip install --upgrade "pillow==8.1.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched version of Pillow.
Conclusion
In conclusion, the vulnerability in Pillow before version 8.1.0 allows for an out-of-bounds write issue when decoding certain YCbCr files in RGBA mode. This can result in arbitrary code execution or a denial of service condition. It is highly recommended to upgrade to the patched version of Pillow to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a Python library for image processing and manipulation. It provides various functions and utilities for working with different image formats.
The vulnerability allows an attacker to overwrite heap-based memory, potentially leading to arbitrary code execution or a denial of service condition.
To fix this vulnerability, upgrade Pillow to version 8.1.0 or later using the command pip install --upgrade pillow.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading Pillow.
The vulnerability has a high severity rating with a CVSS score of 8.8.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
