CVE-2021-34552: Pillow Buffer Overflow Vulnerability
Summary
CVE-2021-34552: Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c. Affects pillow versions < 8.3.0. Fixed in 8.3.0. How to fix ↓
Also tracked for
- pillow · Bitnami
- py3-pillow · Alpine:v3.15
The same CVE-2021-34552 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python library (also known as Python Imaging Library or PIL) used for image processing and manipulation. It provides various functions and methods to handle images in different formats. However, versions up to 8.2.0 of Pillow and PIL 1.1.7 are susceptible to a buffer overflow vulnerability in the Convert.c file. This vulnerability allows an attacker to exploit controlled parameters passed into a convert function, potentially leading to arbitrary code execution or a denial of service attack.
Vulnerability Detail
The vulnerability in Pillow and PIL arises from a lack of proper input validation in the convert function in Convert.c. By crafting malicious input, an attacker can trigger a buffer overflow, causing the program to overwrite adjacent memory and potentially execute arbitrary code. This can result in a compromise of the system or a crash of the application, depending on how the vulnerability is exploited. The impact of this vulnerability can be severe, as it allows an attacker to gain unauthorized access or disrupt the normal functioning of the affected system.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.3.0
This is the first release that contains the fix.
pip install --upgrade "pillow==8.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched version of Pillow or PIL to mitigate the risk of exploitation.
Conclusion
The buffer overflow vulnerability in Pillow and PIL (Python Imaging Library) versions up to 8.2.0 and 1.1.7, respectively, can be exploited by an attacker to execute arbitrary code or cause a denial of service. To mitigate this risk, it is crucial to update to Pillow or PIL version 8.3.0 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a Python library used for image processing and manipulation. It provides various functions and methods to handle images in different formats.
This vulnerability allows an attacker to trigger a buffer overflow, potentially leading to arbitrary code execution or a denial of service attack. It can result in unauthorized access or disruption of the affected system.
To fix this vulnerability, update Pillow or PIL to version 8.3.0 or later. This update includes proper input validation to prevent the buffer overflow.
No, there is no known workaround for this vulnerability. Updating to the patched version is the recommended solution.
For more information, you can refer to the official advisory database for Pillow: https://github.com/pypa/advisory-database/blob/main/vulns/pillow/PYSEC-2021-331.yaml
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
