CVE-2016-0775: Buffer Overflow in Pillow Library
Summary
CVE-2016-0775: Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file. Affects pillow across 2 version ranges.
< 3.1.1
< 893a40850c2d5da41537958e40569c029a6e127b
Fixed in 893a40850c2d5da41537958e40569c029a6e127b. How to fix ↓
Also tracked for
- pillow · Debian:11
The same CVE-2016-0775 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python library for image processing tasks. It provides various functionalities for opening, manipulating, and saving different image file formats. The library is widely used in many applications and frameworks for image-related operations. However, a vulnerability has been discovered in Pillow versions prior to 3.1.1 that allows remote attackers to cause a denial of service (crash) by exploiting a buffer overflow in the ImagingFliDecode function in the libImaging/FliDecode.c file. This vulnerability affects the integrity and stability of applications utilizing Pillow for FLI file processing.
Vulnerability Detail
The vulnerability arises from a buffer overflow in the ImagingFliDecode function within the libImaging/FliDecode.c file of the Pillow library. By crafting a malicious FLI file, remote attackers can trigger the buffer overflow and cause a denial of service (crash) in applications using the vulnerable version of Pillow. The buffer overflow occurs due to insufficient bounds checking when decoding FLI files, allowing an attacker to overwrite adjacent memory locations and disrupt the normal execution flow. This vulnerability can potentially be exploited to execute arbitrary code or escalate privileges, depending on the context in which Pillow is used.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
893a40850c2d5da41537958e40569c029a6e127b
This is the first release that contains the fix.
pip install --upgrade "pillow==893a40850c2d5da41537958e40569c029a6e127b"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if upgrading to the latest version of Pillow is not immediately feasible, developers can implement input validation and sanitization mechanisms to mitigate the risk of exploiting the buffer overflow. By carefully validating and limiting the size of FLI files before processing them with Pillow, the likelihood of triggering the vulnerability can be reduced. However, this workaround is not a substitute for applying the official fix provided in the updated version of Pillow.
Conclusion
The buffer overflow vulnerability in the ImagingFliDecode function of the Pillow library can lead to a denial of service (crash) and potentially enable arbitrary code execution or privilege escalation. To mitigate this risk, it is crucial to upgrade Pillow to version 3.1.1 or later. Developers should promptly apply the necessary updates to ensure the security and stability of their applications. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a Python library for image processing tasks, providing functionalities for opening, manipulating, and saving various image file formats.
The vulnerability allows remote attackers to cause a denial of service (crash) in applications using the vulnerable version of Pillow. Depending on the context, it may also be possible for an attacker to execute arbitrary code or escalate privileges.
To fix this vulnerability, upgrade Pillow to version 3.1.1 or later. This can be done by updating the package using the package manager or manually installing the latest version from PyPI.
As a temporary workaround, developers can implement input validation and sanitization mechanisms to reduce the risk of exploiting the buffer overflow. However, applying the official fix by upgrading to the latest version of Pillow is strongly recommended.
At the time of this report, there is no known public exploit available for this vulnerability. However, it is important to promptly apply the fix to prevent potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
