CVE-2016-9190: Pillow Insecure Sign Extension Vulnerability
Summary
CVE-2016-9190: Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component. Affects pillow versions < 3.3.2. Fixed in 3.3.2. How to fix ↓
Also tracked for
- pillow · Debian:11
The same CVE-2016-9190 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python library for image processing and manipulation. It provides various functionalities for opening, manipulating, and saving many different image file formats. The library is widely used in applications that require image processing capabilities. However, versions of Pillow prior to 3.3.2 are vulnerable to an Insecure Sign Extension issue in the ImagingNew component of the Storage.c module. This vulnerability can be exploited by context-dependent attackers using a crafted image file.
Vulnerability Detail
The Insecure Sign Extension vulnerability in Pillow allows attackers to execute arbitrary code by exploiting the ImagingNew component in the Storage.c module. By manipulating a crafted image file, an attacker can trigger the vulnerability and execute arbitrary code within the context of the application using Pillow. This can lead to various security risks, including remote code execution and unauthorized access to sensitive information.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.2
This is the first release that contains the fix.
pip install --upgrade "pillow==3.3.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Insecure Sign Extension vulnerability in Pillow can be exploited by using a crafted image file, allowing attackers to execute arbitrary code within the context of the application. To mitigate this vulnerability, it is crucial to upgrade Pillow to version 3.3.2 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a Python library for image processing and manipulation. It provides various functionalities for opening, manipulating, and saving many different image file formats.
The vulnerability allows context-dependent attackers to execute arbitrary code by using a crafted image file. This can lead to remote code execution and unauthorized access to sensitive information.
To fix this vulnerability, you should upgrade Pillow to version 3.3.2 or later. This version includes a fix for the Insecure Sign Extension issue.
No specific workarounds have been mentioned for this vulnerability. It is recommended to upgrade to the fixed version of Pillow.
You can find more information about this vulnerability in the official advisory database for Pillow: https://github.com/pypa/advisory-database/blob/main/vulns/pillow/PYSEC-2016-9.yaml
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
