{"items":[{"id":"CVE-2026-114501","published":"2026-10-21T21:17:09.748Z","updated":"2026-10-30T16:10:03.645Z","title":"Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1","severity":"MEDIUM","score":6.3,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2026-96639","published":"2026-10-21T21:06:42.111Z","updated":"2026-10-29T10:51:37.735Z","title":"Pillow multi-frame loaders can reuse stale native image storage after mode transitions","severity":"CRITICAL","score":9.8,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00659,"kevAdded":null},{"id":"CVE-2026-96636","published":"2026-10-21T21:05:20.850Z","updated":"2026-10-30T16:08:33.388Z","title":"Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)","severity":"MEDIUM","score":6.5,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-96640","published":"2026-10-21T21:03:22.785Z","updated":"2026-10-28T01:57:01.680Z","title":"Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion","severity":"HIGH","score":8.2,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00604,"kevAdded":null},{"id":"CVE-2026-96637","published":"2026-10-21T21:01:20.249Z","updated":"2026-10-23T21:18:59.858Z","title":"Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS","severity":"HIGH","score":7.1,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00373,"kevAdded":null},{"id":"CVE-2026-96778","published":"2026-10-21T20:58:24.238Z","updated":"2026-10-28T01:53:22.401Z","title":"Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer","severity":"HIGH","score":7.7,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00454,"kevAdded":null},{"id":"CVE-2026-96643","published":"2026-10-21T20:56:26.344Z","updated":"2026-10-23T21:19:12.901Z","title":"Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time","severity":"HIGH","score":7.1,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00373,"kevAdded":null},{"id":"CVE-2026-96644","published":"2026-10-21T20:54:43.537Z","updated":"2026-10-28T18:22:38.027Z","title":"Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)","severity":"HIGH","score":7.1,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2026-96641","published":"2026-10-21T20:51:24.388Z","updated":"2026-10-28T01:50:42.160Z","title":"Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise","severity":"MEDIUM","score":6.5,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-96642","published":"2026-10-21T20:49:56.989Z","updated":"2026-10-30T16:07:09.659Z","title":"Pillow: TarIO negative size field causes infinite CPU-spin loop","severity":"HIGH","score":7.1,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-96638","published":"2026-10-21T20:47:21.767Z","updated":"2026-10-28T18:21:53.700Z","title":"Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode","severity":"MEDIUM","score":6.5,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-112901","published":"2026-10-19T22:09:52.614Z","updated":"2026-10-20T16:08:29.821Z","title":"Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes","severity":"MEDIUM","score":6.9,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00532,"kevAdded":null},{"id":"CVE-2026-112900","published":"2026-10-19T22:07:50.418Z","updated":"2026-10-20T14:43:44.563Z","title":"Pillow: Argument Injection in Ghostscript call, potentially leading into RCE","severity":"CRITICAL","score":9.2,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.01303,"kevAdded":null},{"id":"CVE-2026-112898","published":"2026-10-19T22:04:23.462Z","updated":"2026-10-28T15:15:44.187Z","title":"Pillow: Image.quantize() with empty palette leaks uninitialized stack memory","severity":"MEDIUM","score":6.9,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2026-112897","published":"2026-10-19T22:00:52.749Z","updated":"2026-10-22T21:13:16.428Z","title":"Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips","severity":"HIGH","score":8.7,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-112896","published":"2026-10-19T21:59:17.743Z","updated":"2026-10-20T13:55:36.949Z","title":"Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read","severity":"HIGH","score":8.8,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00475,"kevAdded":null},{"id":"CVE-2026-112895","published":"2026-10-19T21:57:14.207Z","updated":"2026-10-20T16:08:43.138Z","title":"Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)","severity":"HIGH","score":8.7,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00594,"kevAdded":null},{"id":"CVE-2026-112894","published":"2026-10-19T21:55:19.424Z","updated":"2026-10-20T14:46:13.675Z","title":"Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)","severity":"HIGH","score":8.7,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00594,"kevAdded":null},{"id":"CVE-2026-112893","published":"2026-10-19T21:53:49.979Z","updated":"2026-10-28T15:12:48.729Z","title":"Pillow: Invalid free in FreeType glyph rendering when a stroker is active","severity":"HIGH","score":8.2,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00549,"kevAdded":null},{"id":"CVE-2026-112892","published":"2026-10-19T21:35:25.797Z","updated":"2026-10-22T21:11:24.689Z","title":"Pillow: MSP RLE decoder expands a tiny file into unbounded memory","severity":"HIGH","score":8.7,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2026-112891","published":"2026-10-19T21:33:32.180Z","updated":"2026-10-20T13:54:10.370Z","title":"Pillow: Quadratic GIF comment copying during save","severity":"MEDIUM","score":6.9,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00549,"kevAdded":null},{"id":"CVE-2026-112406","published":"2026-10-19T21:31:49.946Z","updated":"2026-10-20T16:08:57.551Z","title":"Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle","severity":"HIGH","score":8.7,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00573,"kevAdded":null},{"id":"CVE-2026-112405","published":"2026-10-19T21:29:53.515Z","updated":"2026-10-20T15:56:29.299Z","title":"Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0","severity":"HIGH","score":8.7,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00594,"kevAdded":null},{"id":"CVE-2026-112404","published":"2026-10-19T21:27:56.705Z","updated":"2026-10-28T15:18:51.938Z","title":"Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels","severity":"HIGH","score":8.8,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00444,"kevAdded":null},{"id":"CVE-2026-112403","published":"2026-10-19T21:22:21.077Z","updated":"2026-10-22T21:08:58.141Z","title":"Pillow: Heap buffer overflow in ImagingJpegDecode","severity":"CRITICAL","score":9.2,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00945,"kevAdded":null},{"id":"CVE-2026-112402","published":"2026-10-19T21:18:57.027Z","updated":"2026-10-19T21:37:35.120Z","title":"Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform","severity":"HIGH","score":8.7,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00594,"kevAdded":null},{"id":"CVE-2026-112397","published":"2026-10-19T21:17:35.684Z","updated":"2026-10-19T21:38:18.176Z","title":"Pillow: Out-of-bounds access in _imagingmorph on a zero-width image","severity":"HIGH","score":8.7,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00573,"kevAdded":null},{"id":"CVE-2026-112392","published":"2026-10-19T21:17:18.908Z","updated":"2026-10-20T14:50:31.632Z","title":"Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images","severity":"HIGH","score":8.2,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00593,"kevAdded":null},{"id":"CVE-2026-112401","published":"2026-10-19T21:15:21.484Z","updated":"2026-10-20T16:09:15.499Z","title":"Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()","severity":"MEDIUM","score":6.9,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2026-112400","published":"2026-10-19T21:12:37.401Z","updated":"2026-10-20T14:59:57.147Z","title":"Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS","severity":"HIGH","score":8.7,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00594,"kevAdded":null},{"id":"CVE-2026-112399","published":"2026-10-19T21:10:11.266Z","updated":"2026-10-28T15:21:14.748Z","title":"Pillow: APNG background disposal allocates full canvas before decompression bomb check","severity":"HIGH","score":8.7,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00529,"kevAdded":null},{"id":"CVE-2026-112398","published":"2026-10-19T21:07:25.229Z","updated":"2026-10-22T21:06:17.285Z","title":"Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution","severity":"CRITICAL","score":9.2,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00696,"kevAdded":null},{"id":"CVE-2026-112396","published":"2026-10-19T21:02:15.197Z","updated":"2026-10-20T16:09:21.913Z","title":"Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer","severity":"MEDIUM","score":5.9,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00694,"kevAdded":null},{"id":"CVE-2026-112395","published":"2026-10-19T20:59:15.098Z","updated":"2026-10-28T15:24:49.805Z","title":"Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)","severity":"MEDIUM","score":6.5,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-112394","published":"2026-10-19T20:48:28.141Z","updated":"2026-10-22T21:04:15.766Z","title":"Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size","severity":"MEDIUM","score":6.3,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00555,"kevAdded":null},{"id":"CVE-2026-112393","published":"2026-10-19T20:46:40.784Z","updated":"2026-10-19T21:17:41.571Z","title":"Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO","severity":"CRITICAL","score":9.2,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.01019,"kevAdded":null},{"id":"CVE-2026-112391","published":"2026-10-19T20:40:36.285Z","updated":"2026-10-20T16:09:28.294Z","title":"Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()","severity":"MEDIUM","score":6.3,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00581,"kevAdded":null},{"id":"CVE-2026-112390","published":"2026-10-19T20:35:39.189Z","updated":"2026-10-20T15:02:38.367Z","title":"Pillow: Infinite loop in MIC n_frames when the embedded TIFF","severity":"HIGH","score":8.2,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00593,"kevAdded":null},{"id":"CVE-2026-54058","published":"2026-07-14T16:27:38.050Z","updated":"2026-07-14T17:54:25.654Z","title":"Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)","severity":"HIGH","score":8.3,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00521,"kevAdded":null},{"id":"CVE-2026-59197","published":"2026-07-14T16:25:23.520Z","updated":"2026-07-21T18:50:40.019Z","title":"Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`","severity":"HIGH","score":8.2,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2026-59200","published":"2026-07-14T16:09:05.091Z","updated":"2026-07-14T19:52:06.407Z","title":"Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()","severity":"HIGH","score":7.5,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2026-59198","published":"2026-07-14T16:07:56.562Z","updated":"2026-07-14T19:55:56.380Z","title":"Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images","severity":"MEDIUM","score":6.5,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-59205","published":"2026-07-14T15:48:39.962Z","updated":"2026-07-14T17:31:36.064Z","title":"Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch","severity":"HIGH","score":7.5,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2026-59203","published":"2026-07-14T15:43:58.333Z","updated":"2026-07-15T13:52:17.491Z","title":"Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service","severity":"MEDIUM","score":5.3,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2026-59199","published":"2026-07-14T15:42:15.071Z","updated":"2026-07-15T14:53:39.590Z","title":"Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow","severity":"HIGH","score":7.5,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2026-59204","published":"2026-07-14T15:38:29.545Z","updated":"2026-07-21T18:41:18.660Z","title":"Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service","severity":"HIGH","score":8.7,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2026-55379","published":"2026-07-06T18:52:11.633Z","updated":"2026-07-06T19:17:03.941Z","title":"Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading","severity":"HIGH","score":7.5,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00522,"kevAdded":null},{"id":"CVE-2026-55380","published":"2026-07-06T18:50:14.789Z","updated":"2026-07-06T19:23:30.046Z","title":"Pillow GdImageFile decompression bomb protection bypass","severity":"HIGH","score":7.5,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00518,"kevAdded":null},{"id":"CVE-2026-54060","published":"2026-07-06T18:49:23.788Z","updated":"2026-07-07T14:08:14.588Z","title":"Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`","severity":"HIGH","score":7.5,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2026-54059","published":"2026-07-06T18:46:09.433Z","updated":"2026-07-07T16:57:53.021Z","title":"Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading","severity":"HIGH","score":7.5,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.0041,"kevAdded":null},{"id":"CVE-2026-55798","published":"2026-07-06T18:44:38.441Z","updated":"2026-07-07T15:19:40.072Z","title":"Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path","severity":"MEDIUM","score":4.5,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00179,"kevAdded":null},{"id":"CVE-2026-42311","published":"2026-05-09T04:11:58.092Z","updated":"2026-05-12T02:24:33.053Z","title":"Pillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow)","severity":"HIGH","score":8.6,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.0015,"kevAdded":null},{"id":"CVE-2026-42310","published":"2026-05-09T04:10:48.395Z","updated":"2026-05-12T18:31:10.271Z","title":"Pillow: PDF Parsing Trailer Infinite Loop (DoS)","severity":"MEDIUM","score":5.1,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-42308","published":"2026-05-09T04:09:01.631Z","updated":"2026-05-11T15:03:00.916Z","title":"Pillow: Integer overflow when processing fonts","severity":"MEDIUM","score":5.1,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-42309","published":"2026-05-09T04:08:10.517Z","updated":"2026-05-11T14:48:18.204Z","title":"Pillow: Heap buffer overflow with nested list coordinates","severity":"MEDIUM","score":5.1,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-40192","published":"2026-04-15T22:53:56.147Z","updated":"2026-09-10T12:04:47.474Z","title":"Pillow is vulnerable to a FITS GZIP decompression bomb","severity":"HIGH","score":8.7,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00671,"kevAdded":null},{"id":"CVE-2026-25990","published":"2026-02-11T20:53:52.524Z","updated":"2026-09-16T12:04:20.759Z","title":"Pillow has an out-of-bounds write when loading PSD images","severity":"HIGH","score":8.6,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2025-48379","published":"2025-07-01T18:33:30.687Z","updated":"2025-07-01T19:42:22.348Z","title":"Pillow Vulnerable to Write Buffer Overflow on BCn encoding","severity":"HIGH","score":7.1,"vendor":"python-pillow","product":"Pillow","kev":false,"epss":0.00319,"kevAdded":null}]}