Buffer Overflows in Pillow libImaging/TiffDecode.c
Summary
CVE-2020-10379: In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c. Affects pillow across 2 version ranges.
< 7.1.0
< 46f4a349b88915787fea3fb91348bb1665831bbb
Fixed in 46f4a349b88915787fea3fb91348bb1665831bbb. How to fix ↓
Also tracked for
The same CVE-2020-10379 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pillow is a popular Python imaging library that provides support for opening, manipulating, and saving many different image file formats. It is widely used in various applications for image processing and manipulation. However, versions of Pillow before 7.1.0 are affected by two Buffer Overflows in the libImaging/TiffDecode.c module.
Vulnerability Detail
The Buffer Overflows in libImaging/TiffDecode.c can be exploited by an attacker to overwrite adjacent memory locations, leading to potential code execution or denial of service. These vulnerabilities can be triggered by specially crafted TIFF image files, allowing an attacker to execute arbitrary code or crash the application.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
46f4a349b88915787fea3fb91348bb1665831bbb
This is the first release that contains the fix.
pip install --upgrade "pillow==46f4a349b88915787fea3fb91348bb1665831bbb"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to avoid opening untrusted TIFF image files. Additionally, implementing proper input validation and sanitization can help mitigate the risk of exploitation.
Conclusion
The Buffer Overflows in Pillow's libImaging/TiffDecode.c module can be serious security risks, potentially leading to code execution or denial of service. It is crucial to upgrade to the latest version of Pillow (7.1.0 or later) to mitigate these vulnerabilities. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a Python imaging library that provides support for opening, manipulating, and saving various image file formats.
A Buffer Overflow is a vulnerability that occurs when a program writes data beyond the boundaries of a buffer, overwriting adjacent memory locations.
These vulnerabilities can lead to arbitrary code execution or denial of service, depending on how they are exploited.
To fix the vulnerability, upgrade Pillow to version 7.1.0 or later.
A temporary workaround is to avoid opening untrusted TIFF image files and implement proper input validation.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
