VulertSecurity VulertSecurity

Vulnerability Database · PyPI · pillow · Version

pillow 2.5.1

2.5.1 is affected by 138 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 13.0.0.

Critical 12 High 57 Medium 15 Low 1 Unrated 53

All pillow versions & vulnerabilities → Search the database for this package →
Released 10 Jul 2014 Licence non-standard Also known from other sources 125 Newer releases 105 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

pillow 2.5.1 vulnerabilities

138 vulnerabilities cover pillow 2.5.1. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2020-5311: libImaging/SgiRleDecode.c Buffer Overflow in Pillow 9.8 critical 6.2.2 24 May 2022
CVE-2020-5311: Buffer Overflow in Pillow 9.8 critical 6.2.2 24 May 2022
Arbitrary expression injection in Pillow 9.8 critical 9.0.1 12 Jan 2022
CVE-2020-5312: PCX P mode buffer overflow in Pillow 9.8 critical 6.2.2 03 Nov 2021
CVE-2021-34552: Buffer Overflow in Pillow 9.8 critical 8.3.0 05 Oct 2021
CVE-2021-25289: Out of bounds write in Pillow 9.8 critical 8.1.1 29 Mar 2021
CVE-2016-4009: Integer overflow vulnerability in Pillow 9.8 critical 3.1.1 24 Jul 2018
CVE-2026-112393: Pillow Heap Buffer Overflow Vulnerability When Saving TIFF to BytesIO 9.2 critical 13.0.0 21 Oct 2026
CVE-2026-112403: Pillow Heap Buffer Overflow in ImagingJpegDecode 9.2 critical 13.0.0 20 Oct 2026
CVE-2022-24303: Path Traversal in Pillow 9.1 high 9.0.1 11 Mar 2022
CVE-2021-25288: Out-of-bounds Read in Pillow 9.1 high 8.2.0 08 Jun 2021
CVE-2021-25287: Out-of-bounds Read in Pillow 9.1 high 8.2.0 08 Jun 2021
CVE-2026-112902: Pillow Memory Disclosure and Segfault via Crafted TIFF Tags 8.8 high 13.0.0 21 Oct 2026
CVE-2026-112896: Pillow Heap Out-of-Bounds Read Due to TIFF Encoder ColorMap Mismatch 8.8 high 13.0.0 20 Oct 2026
CVE-2023-4863: Pillow Package Heap Buffer Overflow Vulnerability 8.8 high 10.0.1 07 Jul 2026
CVE-2020-5310: Integer overflow in Pillow 8.8 critical 6.2.2 03 Nov 2021
CVE-2020-35654: Out-of-bounds Write in Pillow 8.8 high 8.1.0 18 Mar 2021
CVE-2026-112402: Pillow Double Free Vulnerability in Image.transform Function 8.7 high 13.0.0 21 Oct 2026
CVE-2026-112397: Pillow Zero-Width Image Causes Out-of-Bounds Access 8.7 high 13.0.0 20 Oct 2026
CVE-2026-54058: Pillow Out-of-Bounds Read Vulnerability via Attacker-Controlled Row Stride 8.3 high 12.3.0 23 Jul 2026
CVE-2026-54058: Pillow Out-of-Bounds Read Vulnerability in McIdas AREA Files 8.3 high 12.3.0 20 Jul 2026
CVE-2026-112392: Pillow Package NULL Dereference Vulnerability in ImagingExpand Function 8.2 high 13.0.0 21 Oct 2026
CVE-2026-59197: Pillow Heap Out-of-Bounds Write via Integer Overflow in ImageFilter.RankFilter 8.2 high 12.3.0 20 Jul 2026
CVE-2026-59197: Pillow Heap Out-of-Bounds Write Vulnerability 8.2 high 12.3.0 14 Jul 2026
CVE-2023-50447: Pillow Arbitrary Code Execution Vulnerability 8.1 high 10.2.0 29 Jun 2026
CVE-2023-50447: Arbitrary Code Execution in Pillow 8.1 critical 10.2.0 19 Jan 2024
CVE-2020-11538: Out-of-bounds read in Pillow 8.1 critical 7.1.0 27 Jul 2020
CVE-2020-10379: Buffer overflow in Pillow 7.8 high 7.1.0 27 Jul 2020
CVE-2016-9190: Pillow - Arbitrary Code Execution via Crafted Image File 7.8 high 3.3.2 12 Jul 2018
CVE-2026-59205: Pillow Heap Corruption via ImageCmsTransform Output Mode Mismatch 7.5 high 12.3.0 20 Jul 2026
CVE-2026-59199: Pillow Heap Out-of-Bounds Write via Signed Coordinate Overflow 7.5 high 12.3.0 20 Jul 2026
CVE-2026-55380: Pillow High-Risk Decompression Bomb Vulnerability in GdImageFile 7.5 high 12.3.0 20 Jul 2026
CVE-2026-55379: Pillow High-Risk Decompression Bomb Protection Bypass via BDF Font Loading 7.5 high 12.3.0 20 Jul 2026
CVE-2026-54060: Pillow FontFile.compile() Vulnerability Leading to Unchecked Bitmap Allocation 7.5 high 12.3.0 20 Jul 2026
CVE-2026-54059: Pillow PCF Font Loading Vulnerability - Decompression Bomb Bypass 7.5 high 12.3.0 20 Jul 2026
CVE-2026-59205: Pillow Heap Corruption Vulnerability Due to Mismatched Image Modes 7.5 high 12.3.0 14 Jul 2026
CVE-2026-59199: Pillow Package Heap Out-of-Bounds Write Vulnerability 7.5 high 12.3.0 14 Jul 2026
CVE-2026-54059: Pillow Memory Allocation Vulnerability in PCF Font Handling 7.5 high 12.3.0 06 Jul 2026
CVE-2026-54060: Pillow Package Vulnerability Leading to Excessive Memory Allocation 7.5 high 12.3.0 06 Jul 2026
CVE-2026-55380: Pillow Package Vulnerability Leading to Excessive C-Heap Allocation 7.5 high 12.3.0 06 Jul 2026
CVE-2026-55379: Pillow Package Memory Allocation Vulnerability 7.5 high 12.3.0 06 Jul 2026
CVE-2023-44271: Pillow Denial of Service vulnerability 7.5 high 10.0.0 03 Nov 2023
CVE-2022-45198: Pillow - Data Amplification Vulnerability 7.5 high 9.2.0 14 Nov 2022
CVE-2014-9601: Pillow Denial of Service via PNG Bomb 7.5 high 2.7.0 14 May 2022
Denial of Service (DOS) vulnerability in Pillow's Jpeg2KImagePlugin 7.5 high 2.5.3 14 May 2022
CVE-2021-28677: Uncontrolled Resource Consumption in Pillow 7.5 high 8.2.0 08 Jun 2021
CVE-2021-28676: Potential infinite loop in Pillow 7.5 high 8.2.0 08 Jun 2021
Uncontrolled Resource Consumption in pillow 7.5 medium 8.1.2 23 Apr 2021
CVE-2021-25291: Out of Bounds Read in Pillow 7.5 high 8.2.0 29 Mar 2021
CVE-2021-25290: Out-of-bounds Write in Pillow 7.5 high 8.1.1 29 Mar 2021
CVE-2021-27922: Uncontrolled Resource Consumption in Pillow 7.5 high 8.1.2 18 Mar 2021
CVE-2021-27921: Denial of Service by Uncontrolled Resource Consumption in Pillow 7.5 high 8.1.2 18 Mar 2021
CVE-2021-27923: Denial of Service in Pillow 7.5 high 8.1.2 18 Mar 2021
CVE-2019-19911: Uncontrolled Resource Consumption in Pillow 7.5 high 6.2.2 01 Apr 2020
CVE-2019-16865: DOS attack in Pillow when processing specially crafted image files 7.5 high 6.2.0 22 Oct 2019
CVE-2026-96644: Pillow heap over-read when rendering WMF and EMF images on Windows 7.1 high 13.0.0 22 Oct 2026
CVE-2026-96642: Pillow TarIO can enter an infinite CPU-consuming loop 7.1 high 13.0.0 22 Oct 2026
CVE-2026-96637: Pillow SPIDER image parsing bypasses decompression-bomb checks 7.1 high 13.0.0 22 Oct 2026
CVE-2020-35653: Out-of-bounds Read in Pillow 7.1 high 8.1.0 18 Mar 2021
CVE-2020-5313: Out-of-bounds Read in Pillow 7.1 high 6.2.2 01 Apr 2020
CVE-2026-112901: Pillow Image Processing Library Suffers from ReDoS Vulnerability in XbmImagePlugin 6.9 medium 13.0.0 21 Oct 2026
CVE-2026-112899: Pillow EPS Load Vulnerability Allows Excessive Resource Consumption 6.9 medium 13.0.0 20 Oct 2026
CVE-2024-28219: Pillow Buffer Overflow Vulnerability 6.7 medium 10.3.0 07 Jul 2026
Pillow Buffer Overflow Vulnerability in package 'pillow' 6.7 high 10.3.0 03 Apr 2024
CVE-2026-96641: Pillow integer overflow can corrupt text width calculations 6.5 medium 13.0.0 22 Oct 2026
CVE-2026-96636: Pillow multi-frame decompression-bomb protection bypass 6.5 medium 13.0.0 22 Oct 2026
CVE-2022-22815: Improper Initialization in Pillow 6.5 medium 9.0.0 12 Jan 2022
CVE-2022-22816: Out-of-bounds Read in Pillow 6.5 medium 9.0.0 12 Jan 2022
CVE-2016-0775: Buffer Overflow in Pillow 6.5 high 3.1.1 24 Jul 2018
CVE-2016-2533: Buffer Overflow in Pillow 6.5 high 3.1.1 24 Jul 2018
CVE-2016-0740: Pillow - Buffer Overflow in ImagingLibTiffDecode 6.5 medium 3.1.1 24 Jul 2018
CVE-2026-112394: Pillow Buffer Overread Vulnerability in P;2L and P;4L Decoders 6.3 medium 13.0.0 21 Oct 2026
CVE-2026-42308: Pillow Integer Overflow Vulnerability in Font Glyph Handling 5.5 medium 12.2.0 09 May 2026
CVE-2016-3076: Pillow Buffer overflow in Jpeg2KEncode.c 5.5 high 3.1.2 17 May 2022
CVE-2020-10378: Out-of-bounds read in Pillow 5.5 high 7.1.0 03 Nov 2021
CVE-2021-28675: Denial of Service in Pillow 5.5 high 8.2.0 08 Jun 2021
CVE-2020-10177: Out-of-bounds reads in Pillow 5.5 high 7.1.0 27 Jul 2020
CVE-2020-10994: Out-of-bounds reads in Pillow 5.5 high 7.1.0 27 Jul 2020
CVE-2016-9189: Pillow Integer Overflow Vulnerability 5.5 medium 3.3.2 24 Jul 2018
CVE-2026-42308: Pillow Integer Overflow Vulnerability in Font Processing 5.1 medium 12.2.0 04 May 2026
CVE-2026-55798: Pillow OS Command Injection Vulnerability in WindowsViewer 4.5 medium 12.3.0 20 Jul 2026
CVE-2026-55798: Pillow Command Injection Vulnerability in WindowsViewer 4.5 medium 12.3.0 06 Jul 2026
CVE-2025-48379: Pillow Heap Buffer Overflow Vulnerability in DDS Image Handling N/A unrated 89f1f4626a2aaf5f3d5ca6437f41def2998fbe09 01 Jul 2025
CVE-2023-50447: Arbitrary Code Execution in Pillow N/A high 10.2.0 22 Jan 2024
CVE-2023-44271: Denial of Service Vulnerability in Pillow N/A unrated 1fe1bb49c452b0318cad12ea9d97c3bef188e9a7 03 Nov 2023
Vulnerability in Pillow: Bundled libwebp N/A high 10.0.1 05 Oct 2023
Vulnerability in Pillow's bundled libwebp binaries in imagecodecs package N/A unrated 10.0.1 20 Sep 2023
CVE-2022-45198: Pillow Improper Handling of Highly Compressed GIF Data N/A unrated 11918eac0628ec8ac0812670d9838361ead2d6a4 14 Nov 2022
CVE-2022-45199: Denial of Service Vulnerability in Pillow N/A unrated 2444cddab2f83f28687c7c20871574acbb6dbcf3 14 Nov 2022
Segv on unknown address in jpeg_read_scanlines in Pillow N/A unrated 9887544fafcd13cc8afcfa0c6d0f2e6facc1a8b8 15 Aug 2022
CVE-2022-24303: Pillow before 9.0.1 File Deletion Vulnerability N/A unrated 9.0.1 28 Mar 2022
Infinite loop vulnerability in Pillow N/A low 9.0.0 11 Mar 2022
CVE-2022-22817: Arbitrary Expression Evaluation in Pillow N/A unrated 9.0.0 10 Jan 2022
CVE-2022-22815: Pillow - Improper Initialization of ImagePath.Path in path_getbbox N/A unrated 9.0.0 10 Jan 2022
CVE-2022-22816: Pillow - Buffer Over-read in path_getbbox N/A unrated 9.0.0 10 Jan 2022
CVE-2021-23437: Regular Expression Denial of Service in pillow N/A unrated 9e08eb8f78fdfd2f476e1b20b7cf38683754866b 03 Sep 2021
CVE-2021-34552: Pillow Buffer Overflow Vulnerability N/A unrated 8.3.0 13 Jul 2021
CVE-2021-25287: Out-of-bounds Read in Pillow N/A unrated 8.2.0 02 Jun 2021
CVE-2021-25288: Out-of-Bounds Read in Pillow N/A unrated 8.2.0 02 Jun 2021
CVE-2021-28676: Pillow FLIDecode Infinite Loop Vulnerability N/A unrated 8.2.0 02 Jun 2021
CVE-2021-28677: Pillow EPSImageFile Readline DoS Vulnerability N/A unrated 8.2.0 02 Jun 2021
CVE-2021-28678: Pillow BLPImagePlugin DoS Vulnerability N/A unrated 8.2.0 02 Jun 2021
CVE-2021-28675: Vulnerability in Pillow N/A unrated 8.2.0 02 Jun 2021
CVE-2021-25289: Heap-based Buffer Overflow in Pillow N/A unrated 8.1.1 19 Mar 2021
CVE-2021-25290: Pillow Negative-Offset memcpy Vulnerability N/A unrated 8.1.1 19 Mar 2021
CVE-2021-25291: Out-of-bounds Read Vulnerability in Pillow N/A unrated 8.1.1 19 Mar 2021
CVE-2021-25292: Pillow PDF Parser Regular Expression DoS Vulnerability N/A unrated 8.1.1 19 Mar 2021
CVE-2021-25293: Out-of-Bounds Read in Pillow N/A unrated 8.1.1 19 Mar 2021
CVE-2021-27921: Pillow Denial of Service Vulnerability N/A unrated 8.1.1 03 Mar 2021
CVE-2021-27922: Pillow Denial of Service Vulnerability N/A unrated 8.1.1 03 Mar 2021
CVE-2021-27923: Pillow Denial of Service Vulnerability N/A unrated 8.1.1 03 Mar 2021
CVE-2020-35653: Pillow PCXDecode Buffer Over-read Vulnerability N/A unrated 8.1.0 12 Jan 2021
CVE-2020-35654: Heap-based Buffer Overflow in Pillow N/A unrated 8.1.0 12 Jan 2021
CVE-2020-10177: Pillow Out-of-Bounds Read Vulnerability N/A unrated 7.1.0 25 Jun 2020
Out-of-Bounds Read Vulnerability in Pillow N/A unrated 6a83e4324738bb0452fbe8074a995b1c73f08de7 25 Jun 2020
Buffer Overflows in Pillow libImaging/TiffDecode.c N/A unrated 46f4a349b88915787fea3fb91348bb1665831bbb 25 Jun 2020
CVE-2020-10994: Out-of-Bounds Read in Pillow N/A unrated 7.0.0 25 Jun 2020
CVE-2020-11538: Pillow - Out-of-Bounds Read in SGI Image Parsing N/A unrated 7.1.0 25 Jun 2020
CVE-2019-19911: Denial of Service Vulnerability in Pillow N/A unrated 6.2.2 05 Jan 2020
CVE-2019-19911: DoS Vulnerability in Pillow N/A unrated 6.2.2 05 Jan 2020
CVE-2020-5310: Integer Overflow in libImaging/TiffDecode.c in Pillow N/A unrated 4e2def2539ec13e53a82e06c4b3daf00454100c4 03 Jan 2020
CVE-2020-5312: Pillow - PCX P mode buffer overflow N/A unrated 93b22b846e0269ee9594ff71a72bec02d2bea8fd 03 Jan 2020
CVE-2020-5313: Pillow - FLI Buffer Overflow N/A unrated a09acd0decd8a87ccce939d5ff65dab59e7d365b 03 Jan 2020
CVE-2020-5311: SGI Buffer Overflow in Pillow N/A unrated a79b65c47c7dc6fe623aadf09aa6192fc54548f3 03 Jan 2020
CVE-2019-16865: Pillow - Memory Allocation and Processing Time Vulnerability N/A unrated 6.2.0 04 Oct 2019
CVE-2019-16865: Pillow - Memory Allocation and Processing Time Vulnerability N/A unrated 6.2.0 04 Oct 2019
CVE-2016-3076: Heap-based buffer overflow in Pillow N/A unrated 3.1.2 24 Apr 2017
CVE-2016-9189: Pillow Integer Overflow Vulnerability N/A unrated 3.3.2 04 Nov 2016
CVE-2016-9190: Pillow Insecure Sign Extension Vulnerability N/A unrated 3.3.2 04 Nov 2016
CVE-2016-0740: Buffer Overflow in Pillow Library N/A unrated 6dcbf5bd96b717c58d7b642949da8d323099928e 13 Apr 2016
CVE-2016-0775: Buffer Overflow in Pillow Library N/A unrated 893a40850c2d5da41537958e40569c029a6e127b 13 Apr 2016
CVE-2016-4009: Integer Overflow in Pillow Allows Heap-based Buffer Overflow N/A unrated 4e0d9b0b9740d258ade40cce248c93777362ac1e 13 Apr 2016
CVE-2016-2533: Pillow Buffer Overflow Vulnerability N/A unrated 5bdf54b5a76b54fb00bd05f2d733e0a4173eefc9 13 Apr 2016
CVE-2014-3598: Denial of Service Vulnerability in Pillow N/A unrated 2.5.3 01 May 2015
CVE-2014-9601: Pillow PNG Image Decompression Denial of Service N/A unrated 2.7.0 16 Jan 2015
CVE-2014-3589: Pillow - Denial of Service via Crafted Block Size N/A unrated 205e056f8f9b06ed7b925cf8aa0874bc4aaf8a7d 25 Aug 2014
CVE-2014-1933: Pillow - Symlink Attack Vulnerability N/A unrated 4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7 17 Apr 2014
CVE-2014-1932: Pillow - Insecure Temporary File Creation N/A unrated 4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7 17 Apr 2014

Looking for another version, or everything Vulert holds for pillow?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About pillow 2.5.1

Is pillow 2.5.1 vulnerable?

Yes. 138 vulnerabilities in the Vulert database cover pillow 2.5.1: 12 critical, 57 high, 15 medium and 1 low, plus 53 not yet rated. The upgrade Vulert recommends is 13.0.0, and each entry above names the fixed version to move to.

Which version of pillow should I use instead of 2.5.1?

13.0.0 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 2.5.1 the latest release of pillow?

No. 2.5.1 was published 10 Jul 2014, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor pillow for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the pillow version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.