VulertSecurity VulertSecurity

Vulnerability Database · PyPI · pillow · Version

pillow 9.3.0

9.3.0 is affected by 78 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 13.0.0.

Critical 4 High 44 Medium 20 Low 0 Unrated 10

All pillow versions & vulnerabilities → Source repository Search the database for this package →
Released 29 Oct 2022 Licence HPND Also known from other sources 62 Newer releases 105 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

pillow 9.3.0 vulnerabilities

78 vulnerabilities cover pillow 9.3.0. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-112393: Pillow Heap Buffer Overflow Vulnerability When Saving TIFF to BytesIO 9.2 critical 13.0.0 21 Oct 2026
CVE-2026-112900: Pillow Command Injection Vulnerability Leading to Potential RCE 9.2 critical 13.0.0 21 Oct 2026
CVE-2026-112403: Pillow Heap Buffer Overflow in ImagingJpegDecode 9.2 critical 13.0.0 20 Oct 2026
CVE-2026-112902: Pillow Memory Disclosure and Segfault via Crafted TIFF Tags 8.8 high 13.0.0 21 Oct 2026
CVE-2026-112896: Pillow Heap Out-of-Bounds Read Due to TIFF Encoder ColorMap Mismatch 8.8 high 13.0.0 20 Oct 2026
CVE-2026-112404: Pillow OOB Read Vulnerability Leading to Heap Memory Disclosure 8.8 high 13.0.0 20 Oct 2026
CVE-2023-4863: Pillow Package Heap Buffer Overflow Vulnerability 8.8 high 10.0.1 07 Jul 2026
CVE-2026-112406: Pillow Infinite Loop Vulnerability in PdfParser 8.7 high 13.0.0 21 Oct 2026
CVE-2026-112399: Pillow Memory Allocation Vulnerability Due to APNG Background Disposal 8.7 high 13.0.0 21 Oct 2026
CVE-2026-112892: Pillow MSP RLE Decoder Memory Exhaustion Vulnerability 8.7 high 13.0.0 21 Oct 2026
CVE-2026-112894: Pillow Quadratic-time DoS in PDF save_all Functionality 8.7 high 13.0.0 21 Oct 2026
CVE-2026-112402: Pillow Double Free Vulnerability in Image.transform Function 8.7 high 13.0.0 21 Oct 2026
CVE-2026-112397: Pillow Zero-Width Image Causes Out-of-Bounds Access 8.7 high 13.0.0 20 Oct 2026
CVE-2026-112400: Pillow GIF Memory Exhaustion Vulnerability 8.7 high 13.0.0 20 Oct 2026
CVE-2026-112897: Pillow Vulnerability - Uninitialized Memory Exposure in TiffDecode 8.7 high 13.0.0 20 Oct 2026
CVE-2026-112895: Pillow Unbounded Recursion in PDF Parsing 8.7 high 13.0.0 20 Oct 2026
CVE-2026-59204: Pillow Denial of Service Vulnerability due to JPEG2000 Tiled Decode Memory Exhaustion 8.7 high 12.3.0 23 Jul 2026
CVE-2026-59204: Pillow Denial of Service Vulnerability in JPEG2000 Tiled Decode 8.7 high 12.3.0 20 Jul 2026
CVE-2026-54058: Pillow Out-of-Bounds Read Vulnerability via Attacker-Controlled Row Stride 8.3 high 12.3.0 23 Jul 2026
CVE-2026-54058: Pillow Out-of-Bounds Read Vulnerability in McIdas AREA Files 8.3 high 12.3.0 20 Jul 2026
CVE-2026-96640: Pillow PDF append can cause resource exhaustion 8.2 high 13.0.0 22 Oct 2026
CVE-2026-112390: Pillow Infinite Loop Vulnerability in MIC n_frames Handling 8.2 high 13.0.0 21 Oct 2026
CVE-2026-112392: Pillow Package NULL Dereference Vulnerability in ImagingExpand Function 8.2 high 13.0.0 21 Oct 2026
CVE-2026-59197: Pillow Heap Out-of-Bounds Write via Integer Overflow in ImageFilter.RankFilter 8.2 high 12.3.0 20 Jul 2026
CVE-2026-59197: Pillow Heap Out-of-Bounds Write Vulnerability 8.2 high 12.3.0 14 Jul 2026
CVE-2023-50447: Pillow Arbitrary Code Execution Vulnerability 8.1 high 10.2.0 29 Jun 2026
CVE-2023-50447: Arbitrary Code Execution in Pillow 8.1 critical 10.2.0 19 Jan 2024
CVE-2026-59200: Pillow Denial-of-Service Vulnerability via PdfParser.PdfStream.decode() 7.5 high 12.3.0 23 Jul 2026
CVE-2026-59205: Pillow Heap Corruption via ImageCmsTransform Output Mode Mismatch 7.5 high 12.3.0 20 Jul 2026
CVE-2026-59200: Pillow Denial-of-Service Vulnerability via Decompression Bomb in PdfParser 7.5 high 12.3.0 20 Jul 2026
CVE-2026-59199: Pillow Heap Out-of-Bounds Write via Signed Coordinate Overflow 7.5 high 12.3.0 20 Jul 2026
CVE-2026-55380: Pillow High-Risk Decompression Bomb Vulnerability in GdImageFile 7.5 high 12.3.0 20 Jul 2026
CVE-2026-55379: Pillow High-Risk Decompression Bomb Protection Bypass via BDF Font Loading 7.5 high 12.3.0 20 Jul 2026
CVE-2026-54060: Pillow FontFile.compile() Vulnerability Leading to Unchecked Bitmap Allocation 7.5 high 12.3.0 20 Jul 2026
CVE-2026-54059: Pillow PCF Font Loading Vulnerability - Decompression Bomb Bypass 7.5 high 12.3.0 20 Jul 2026
CVE-2026-59205: Pillow Heap Corruption Vulnerability Due to Mismatched Image Modes 7.5 high 12.3.0 14 Jul 2026
CVE-2026-59199: Pillow Package Heap Out-of-Bounds Write Vulnerability 7.5 high 12.3.0 14 Jul 2026
CVE-2026-55379: Pillow Package Memory Allocation Vulnerability 7.5 high 12.3.0 06 Jul 2026
CVE-2026-55380: Pillow Package Vulnerability Leading to Excessive C-Heap Allocation 7.5 high 12.3.0 06 Jul 2026
CVE-2026-54060: Pillow Package Vulnerability Leading to Excessive Memory Allocation 7.5 high 12.3.0 06 Jul 2026
CVE-2026-54059: Pillow Memory Allocation Vulnerability in PCF Font Handling 7.5 high 12.3.0 06 Jul 2026
CVE-2023-44271: Pillow Denial of Service vulnerability 7.5 high 10.0.0 03 Nov 2023
CVE-2026-96644: Pillow heap over-read when rendering WMF and EMF images on Windows 7.1 high 13.0.0 22 Oct 2026
CVE-2026-96642: Pillow TarIO can enter an infinite CPU-consuming loop 7.1 high 13.0.0 22 Oct 2026
CVE-2026-96637: Pillow SPIDER image parsing bypasses decompression-bomb checks 7.1 high 13.0.0 22 Oct 2026
CVE-2026-112901: Pillow Image Processing Library Suffers from ReDoS Vulnerability in XbmImagePlugin 6.9 medium 13.0.0 21 Oct 2026
CVE-2026-112898: Pillow Image.quantize() Stack Memory Leak Vulnerability 6.9 medium 13.0.0 21 Oct 2026
CVE-2026-112401: Pillow Quadratic GIF Comment Concatenation Vulnerability 6.9 medium 13.0.0 21 Oct 2026
CVE-2026-112891: Pillow Package Suffers from Quadratic GIF Comment Copying Vulnerability 6.9 medium 13.0.0 21 Oct 2026
CVE-2026-112899: Pillow EPS Load Vulnerability Allows Excessive Resource Consumption 6.9 medium 13.0.0 20 Oct 2026
CVE-2024-28219: Pillow Buffer Overflow Vulnerability 6.7 medium 10.3.0 07 Jul 2026
Pillow Buffer Overflow Vulnerability in package 'pillow' 6.7 high 10.3.0 03 Apr 2024
CVE-2026-96641: Pillow integer overflow can corrupt text width calculations 6.5 medium 13.0.0 22 Oct 2026
CVE-2026-96638: Pillow BMP RLE decoder permits memory-amplification denial of service 6.5 medium 13.0.0 22 Oct 2026
CVE-2026-96636: Pillow multi-frame decompression-bomb protection bypass 6.5 medium 13.0.0 22 Oct 2026
CVE-2026-112395: Pillow Tiled-TIFF Decoder Buffer Over-read Vulnerability 6.5 medium 13.0.0 20 Oct 2026
CVE-2026-59198: Pillow TGA RLE Encoder Heap Data Serialization Vulnerability 6.5 medium 12.3.0 23 Jul 2026
CVE-2026-59198: Pillow TGA RLE Encoder Heap Disclosure Vulnerability 6.5 medium 12.3.0 20 Jul 2026
CVE-2026-112391: Pillow Package Suffers from Unbounded Recursion in PDF Parsing 6.3 medium 13.0.0 21 Oct 2026
CVE-2026-112394: Pillow Buffer Overread Vulnerability in P;2L and P;4L Decoders 6.3 medium 13.0.0 21 Oct 2026
CVE-2026-42310: Pillow PDF Parsing Trailer Infinite Loop (DoS) Vulnerability 5.5 medium 12.2.0 13 Jul 2026
CVE-2026-42308: Pillow Integer Overflow Vulnerability in Font Glyph Handling 5.5 medium 12.2.0 09 May 2026
CVE-2026-42310: Pillow PDF Parsing Trailer Infinite Loop Vulnerability 5.1 medium 12.2.0 04 May 2026
CVE-2026-42308: Pillow Integer Overflow Vulnerability in Font Processing 5.1 medium 12.2.0 04 May 2026
CVE-2026-55798: Pillow OS Command Injection Vulnerability in WindowsViewer 4.5 medium 12.3.0 20 Jul 2026
CVE-2026-55798: Pillow Command Injection Vulnerability in WindowsViewer 4.5 medium 12.3.0 06 Jul 2026
CVE-2025-48379: Pillow Heap Buffer Overflow Vulnerability in DDS Image Handling N/A unrated 89f1f4626a2aaf5f3d5ca6437f41def2998fbe09 01 Jul 2025
CVE-2023-50447: Arbitrary Code Execution in Pillow N/A high 10.2.0 22 Jan 2024
CVE-2023-44271: Denial of Service Vulnerability in Pillow N/A unrated 1fe1bb49c452b0318cad12ea9d97c3bef188e9a7 03 Nov 2023
Vulnerability in Pillow: Bundled libwebp N/A high 10.0.1 05 Oct 2023
Vulnerability in Pillow's bundled libwebp binaries in imagecodecs package N/A unrated 10.0.1 20 Sep 2023
CVE-2022-45199: Denial of Service Vulnerability in Pillow N/A unrated 2444cddab2f83f28687c7c20871574acbb6dbcf3 14 Nov 2022
CVE-2022-45198: Pillow Improper Handling of Highly Compressed GIF Data N/A unrated 11918eac0628ec8ac0812670d9838361ead2d6a4 14 Nov 2022
Segv on unknown address in jpeg_read_scanlines in Pillow N/A unrated 9887544fafcd13cc8afcfa0c6d0f2e6facc1a8b8 15 Aug 2022
Buffer Overflows in Pillow libImaging/TiffDecode.c N/A unrated 46f4a349b88915787fea3fb91348bb1665831bbb 25 Jun 2020
CVE-2020-5312: Pillow - PCX P mode buffer overflow N/A unrated 93b22b846e0269ee9594ff71a72bec02d2bea8fd 03 Jan 2020
CVE-2016-0775: Buffer Overflow in Pillow Library N/A unrated 893a40850c2d5da41537958e40569c029a6e127b 13 Apr 2016
CVE-2014-3589: Pillow - Denial of Service via Crafted Block Size N/A unrated 205e056f8f9b06ed7b925cf8aa0874bc4aaf8a7d 25 Aug 2014

Looking for another version, or everything Vulert holds for pillow?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About pillow 9.3.0

Is pillow 9.3.0 vulnerable?

Yes. 78 vulnerabilities in the Vulert database cover pillow 9.3.0: 4 critical, 44 high, 20 medium and 0 low, plus 10 not yet rated. The upgrade Vulert recommends is 13.0.0, and each entry above names the fixed version to move to.

Which version of pillow should I use instead of 9.3.0?

13.0.0 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 9.3.0 the latest release of pillow?

No. 9.3.0 was published 29 Oct 2022, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor pillow for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the pillow version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.