CVE-2021-25290: Pillow Negative-Offset memcpy Vulnerability
Summary
CVE-2021-25290: An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size. Affects pillow versions < 8.1.1. Fixed in 8.1.1. How to fix ↓
Also tracked for
- pillow · Bitnami
- py3-pillow · Alpine:v3.14
The same CVE-2021-25290 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python library for image processing and manipulation. It provides various functionalities for opening, manipulating, and saving many different image file formats. The library is widely used in applications that require image processing capabilities. However, a vulnerability has been discovered in Pillow versions before 8.1.1 that can lead to a negative-offset memcpy with an invalid size in the TiffDecode.c file.
Vulnerability Detail
The vulnerability in Pillow arises from a negative-offset memcpy operation with an invalid size. This can potentially result in memory corruption or arbitrary code execution. An attacker could exploit this vulnerability by crafting a specially crafted TIFF image file and tricking a user or application into opening it using a vulnerable version of Pillow. Successful exploitation of this vulnerability could lead to a denial of service, information disclosure, or remote code execution.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.1.1
This is the first release that contains the fix.
pip install --upgrade "pillow==8.1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to update to the latest secure version of Pillow as soon as possible.
Conclusion
In conclusion, the CVE-2021-25290 vulnerability in Pillow versions before 8.1.1 can lead to memory corruption or arbitrary code execution. It is crucial to update to the latest secure version of Pillow (8.1.1 or later) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a Python library for image processing and manipulation. It provides various functionalities for opening, manipulating, and saving many different image file formats.
This vulnerability can lead to memory corruption or arbitrary code execution. An attacker could exploit it by tricking a user or application into opening a specially crafted TIFF image file.
To fix this vulnerability, it is recommended to upgrade to Pillow version 8.1.1 or later by running 'pip install --upgrade pillow'.
No, there is no known workaround for this vulnerability. It is crucial to update to the latest secure version of Pillow.
You can find more information about this vulnerability in the official advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/pillow/PYSEC-2021-36.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
