CVE-2020-10994: Out-of-Bounds Read in Pillow
Summary
CVE-2020-10994: In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file. Affects pillow versions < 7.0.0. Fixed in 7.0.0. How to fix ↓
Also tracked for
The same CVE-2020-10994 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pillow is a popular Python library for image processing and manipulation. It provides various functionalities for opening, manipulating, and saving many different image file formats. The library is widely used in applications that require image processing capabilities. However, a vulnerability has been discovered in Pillow versions prior to 7.1.0 that allows for multiple out-of-bounds reads when processing a crafted JP2 file.
Vulnerability Detail
The vulnerability originates from the libImaging/Jpeg2KDecode.c file in Pillow. By exploiting this flaw, an attacker can create a specially crafted JP2 file that triggers out-of-bounds reads. These out-of-bounds reads can lead to information disclosure or potentially be leveraged to execute arbitrary code. The vulnerability was assigned the identifier CVE-2020-10994 and has been documented in the PyPI advisory database.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.0
This is the first release that contains the fix.
pip install --upgrade "pillow==7.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At present, there is no known workaround for this vulnerability. It is strongly advised to apply the recommended fix by upgrading to the latest version of Pillow.
Conclusion
In conclusion, the vulnerability CVE-2020-10994 in Pillow versions prior to 7.1.0 allows for multiple out-of-bounds reads when processing a crafted JP2 file. It is crucial to upgrade to the latest version of Pillow and ensure that all dependencies are also updated to mitigate the risk of information disclosure or arbitrary code execution. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a Python library used for image processing and manipulation. It provides various functions for opening, manipulating, and saving different image file formats.
This vulnerability allows for out-of-bounds reads when processing a specially crafted JP2 file. It can potentially lead to information disclosure or arbitrary code execution.
To fix this vulnerability, it is recommended to upgrade Pillow to version 7.1.0 or later. Ensure that all dependencies are also updated to their latest secure versions.
No, there is currently no known workaround for this vulnerability. Upgrading to the latest version of Pillow is the recommended solution.
You can find more information about this vulnerability in the PyPI advisory database or by contacting the Pillow development team.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
