Out-of-Bounds Read Vulnerability in Pillow
Summary
CVE-2020-10378: In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer. Affects pillow across 2 version ranges.
< 6a83e4324738bb0452fbe8074a995b1c73f08de7
< 7.1.0
Fixed in 6a83e4324738bb0452fbe8074a995b1c73f08de7. How to fix ↓
Also tracked for
The same CVE-2020-10378 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pillow is a popular Python library for image processing and manipulation. It provides a wide range of functions and supports various image file formats. However, a vulnerability has been discovered in Pillow versions prior to 7.1.0 that can lead to an out-of-bounds read when processing PCX files. This vulnerability occurs when the 'shuffle' parameter is instructed to read beyond the buffer, resulting in potential memory access issues.
Vulnerability Detail
The vulnerability in Pillow allows an attacker to trigger an out-of-bounds read by providing a specially crafted PCX file. By exploiting this vulnerability, an attacker could potentially read sensitive information from memory or cause the application to crash. The issue originates from a flaw in the 'PcxDecode.c' file of the library. The vulnerability was addressed in version 7.1.0 of Pillow.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6a83e4324738bb0452fbe8074a995b1c73f08de7
This is the first release that contains the fix.
pip install --upgrade "pillow==6a83e4324738bb0452fbe8074a995b1c73f08de7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a workaround can be implemented by avoiding the use of PCX files with Pillow or by implementing additional input validation and sanitization measures when processing PCX files.
Conclusion
The out-of-bounds read vulnerability in Pillow versions prior to 7.1.0 can be exploited by providing a specially crafted PCX file. To mitigate this vulnerability, it is recommended to upgrade Pillow to version 7.1.0 or later. If immediate upgrading is not possible, alternative measures such as avoiding the use of PCX files or implementing input validation can be employed. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a Python library for image processing and manipulation. It provides various functions and supports multiple image file formats.
An out-of-bounds read vulnerability occurs when a program accesses memory outside the bounds of a defined buffer. This can lead to information disclosure or application crashes.
The vulnerability can be exploited by providing a specially crafted PCX file to the Pillow library, triggering an out-of-bounds read during the file processing.
Yes, the vulnerability has been fixed in version 7.1.0 of Pillow. It is recommended to upgrade to this version or later to mitigate the risk.
If immediate upgrading is not possible, a workaround can be implemented by avoiding the use of PCX files with Pillow or by implementing additional input validation measures.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
