CVE-2016-9189: Pillow Integer Overflow Vulnerability
Summary
CVE-2016-9189: Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer Overflow" issue affecting the Image.core.map_buffer in map.c compo... Affects pillow versions < 3.3.2. Fixed in 3.3.2. How to fix ↓
Also tracked for
- pillow · Debian:11
The same CVE-2016-9189 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python imaging library that provides support for opening, manipulating, and saving many different image file formats. It is widely used in various applications for image processing and manipulation. However, versions of Pillow prior to 3.3.2 are vulnerable to an Integer Overflow issue in the Image.core.map_buffer component of the map.c file. This vulnerability can be exploited by context-dependent attackers using a crafted image file approach to obtain sensitive information.
Vulnerability Detail
The Integer Overflow vulnerability in Pillow arises due to a flaw in the Image.core.map_buffer function in the map.c component. By exploiting this vulnerability, an attacker can trigger an integer overflow, leading to the disclosure of sensitive information. This can have serious consequences, as the attacker may gain access to confidential data or exploit the vulnerability to further compromise the system. It is important to note that this vulnerability specifically affects versions of Pillow prior to 3.3.2.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.2
This is the first release that contains the fix.
pip install --upgrade "pillow==3.3.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of Pillow to mitigate the risk of exploitation.
Conclusion
The Integer Overflow vulnerability in Pillow can have serious consequences, allowing attackers to obtain sensitive information. It is crucial to update to the fixed version of Pillow (3.3.2 or later) to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a Python imaging library that provides support for opening, manipulating, and saving various image file formats.
This vulnerability allows attackers to obtain sensitive information by exploiting an Integer Overflow issue in Pillow. It can lead to the disclosure of confidential data and potential further compromise of the system.
Versions of Pillow prior to 3.3.2 are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is recommended to update to the fixed version of Pillow.
To fix this vulnerability, upgrade to Pillow version 3.3.2 or later using the command 'pip install --upgrade pillow==3.3.2'.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
