CVE-2022-22816: Pillow - Buffer Over-read in path_getbbox
Summary
CVE-2022-22816: path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. Affects pillow versions < 9.0.0. Fixed in 9.0.0. How to fix ↓
Also tracked for
- pillow · Bitnami
- py3-pillow · Alpine:v3.15
The same CVE-2022-22816 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python imaging library that provides support for opening, manipulating, and saving many different image file formats. It is widely used in various applications for image processing and manipulation tasks. However, prior to version 9.0.0, Pillow is vulnerable to a buffer over-read during the initialization of ImagePath.Path in the path_getbbox function in path.c.
Vulnerability Detail
The vulnerability (CVE-2022-22816) arises due to a buffer over-read issue in the path_getbbox function of Pillow. During the initialization of ImagePath.Path, an attacker can exploit this flaw to read beyond the bounds of a buffer, potentially leading to information disclosure or a crash. The vulnerability was discovered on January 10, 2022, and was assigned the CVE identifier CVE-2022-22816. It has the potential to impact systems using vulnerable versions of Pillow.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.0.0
This is the first release that contains the fix.
pip install --upgrade "pillow==9.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As of now, no official workaround has been provided for this vulnerability. It is strongly advised to upgrade to the fixed version of Pillow (9.0.0 or later) to mitigate the risk.
Conclusion
In conclusion, the vulnerability (CVE-2022-22816) in Pillow prior to version 9.0.0 exposes systems to a buffer over-read issue during the initialization of ImagePath.Path. To mitigate the risk, it is crucial to upgrade to the fixed version of Pillow (9.0.0 or later). For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a Python imaging library that provides support for opening, manipulating, and saving various image file formats.
The vulnerability can potentially lead to information disclosure or a crash, depending on how it is exploited.
To fix this vulnerability, it is recommended to upgrade to version 9.0.0 or later of Pillow.
No official workaround has been provided. Upgrading to the fixed version is the recommended solution.
For more information, you can refer to the official advisory database for Pillow: https://github.com/pypa/advisory-database/blob/main/vulns/pillow/PYSEC-2022-9.yaml
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
