BIT-pillow-2026-112394

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/pillow/BIT-pillow-2026-112394.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-pillow-2026-112394

Aliases

Published

2026-10-26T05:55:35Z

Modified

2026-10-27T11:10:34Z

Summary

Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size

Details

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can read past the end of an input buffer. ImagingRawDecode calculates a packed-pixel row size, while the unpackers read separately padded bit planes. A caller can supply a buffer and image dimensions whose accepted size is smaller than the unpacker's actual footprint. This can disclose up to three adjacent heap bytes in output pixels or crash the process. This issue is fixed in version 13.0.0.

Database specific

{
    "cpes":  [
        "cpe:2.3:a:python:pillow:*:*:*:*:*:python:*:*"
    ],
    "severity":  "High"
}

References

Affected packages

Bitnami / pillow

Package

Name: pillow
Purl: pkg:bitnami/pillow

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

13.0.0

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/pillow/BIT-pillow-2026-112394.json"