Pillow vulnerabilities

In Pillow's libtiff encoder (PyImaging_LibTiffEncoderNew in src/encode.c), crafted TIFF tags can cause memory disclosure and a segfault. The issue occurs when creating the LibTiff encoder.

Pillow (PIL) in EpsImagePlugin.py in Ghostscript() lets Ghostscript render past the decompression bomb limit when loading EPS with scale. This can lead to excessive resource consumption.

Pillow wheels from 11.1.0 onward bundle a libopenjp2 containing a heap-buffer-overflow write that is fixed upstream on master but has never appeared in an OpenJPEG release. Because the wheel bundles its own copy, a patched host library does not protect against the issue.

Pillow versions 11.0.0 through 13.0.0 mishandle multi-frame images (PSD, MPO, DCX, MIC). When a later frame switches to a wider mode (RGB/CMYK), the stale narrow-mode buffer is reused, causing out-of-bounds writes and crashes, and in some runtime profiles command execution.

Pillow, a Python imaging library, from 2.6.0 until 13.0.0 is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a hyphen can be interpreted as a Ghostscript option.

Pillow prior to 13.0.0 has a JPEG decoder vulnerability where a full-width scanline can be written into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width after scaling, and an 8-bit lossless SOF3 JPEG decoded by libjpeg-turbo 3.x can ignore the requested downscaling geometry.

Pillow prior to 13.0.0 has a FlashPix JPEG-tile decoder vulnerability that can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four components, causing ImagingJpegDecode to write four-component scanlines into the two-byte tile buffer.

Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback sizes its allocation from the prior buffer size instead of the current write position, allowing data to be copied beyond the allocation. This is fixed in version 13.0.0.

A vulnerability in Pillow before version 12.3.0 allows an attacker to read process memory or cause a fault when loading an uncompressed McIdas AREA image via the mmap codec path. Attacker-controlled header words can set a row stride smaller than the natural row width, leading to out-of-bounds read beyond the mapped region.

Integer overflow in the ImagingResampleHorizontal function in Pillow before version 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, leading to a heap-based buffer overflow.

Pillow versions 11.2.1 through 13.0.0 incorrectly assume image rows are tightly contiguous when exporting to Arrow. When PILLOW_ALIGNMENT causes row padding or an aligned offset before the first row, the resulting Arrow buffer may include uninitialized padding, bytes preceding the first row, or stale heap contents from previously freed images. This can disclose one user's pixels or other process memory to another user.

Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted free_in_buffer counter, which then wraps and permits the attacker-controlled comment and subsequent compressed image data to overwrite adjacent heap memory. Re-saving an untrusted image as JPEG while preserving its ICC profile and forwarded comment can crash the process and may enable code execution in suitable runtime and heap layouts. This issue is fixed in version 13.0.0.

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler, which sizes a DIB allocation from 16-bit-truncated dimensions but copies pixel data using the original full dimensions, allowing a heap buffer over-read.

In Pillow from 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. Because src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, a file filled with repeated headers causes a new shrinking copy on every iteration and quadratic CPU work. The condition is reachable through Image.getexif(), Image._getexif(), and ImageOps.exif_transpose(), including common photo-upload rotation workflows. This issue is fixed in version 13.0.0.

In Pillow prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consumes a full CPU core, and never returns. TarIO is reached only when an application directly uses PIL.TarIO.TarIO rather than the default Image.open() path. This issue is fixed in version 13.0.0.

Pillow, a Python imaging library, prior to 13.0.0 has a flaw in PILfont text-width accumulation in src/_imaging.c where positive glyph advances are checked against INT_MAX but negative advances are not checked against INT_MIN. Repeating a signed 16-bit advance of -32768 can execute a signed C integer overflow in xsize += dx, producing a large positive width from a negative mathematical result, which can cause logic-integrity errors or resource consumption in applications using getlength(), getsize(), or derived layout, quota, serialization, or allocation calculations.

Pillow versions 5.1.0 through 13.0.0 fail to track duplicate indirect references in a PDF /Pages graph. A compact malformed PDF can cause exponentially many page references and disproportionate CPU consumption when Image.save with append=True processes an attacker-controlled PDF.

Pillow, a Python imaging library, from 9.1.0 until 13.0.0 allows BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py to append beyond the remaining dest_length without a per-branch cap via crafted RLE BMP delta escapes and absolute-mode runs. A delta can add roughly 255 image rows in one iteration, so a kilobyte-sized file with a large but permitted width can expand the data bytearray to hundreds of megabytes or more, causing memory-exhaustion denial of service.

In Pillow prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0.

Pillow, a Python imaging library, prior to 13.0.0 allows MpoImageFile.seek() and DcxImageFile.seek() to reparse later MPO or DCX frames and replace self._size without rerunning Image._decompression_bomb_check(). A crafted multi-frame image can use a tiny first frame to pass Image.open() and then declare an over-limit later frame, which during normal frame iteration through seek(), load(), or ImageSequence.Iterator can decode that frame and commit hundreds of megabytes or more, causing memory-exhaustion denial of service.

Pillow prior to 13.0.0 is vulnerable to regular-expression denial of service in its XBM header parser. Calling Image.open() on a small crafted XBM file causes a backtracking expression to be applied to the attacker-controlled header, stalling a worker for minutes.

Pillow from 9.1.0 until 13.0.0 can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as output pixel indices in a returned PNG or GIF.

In Pillow from 5.3.0 until 13.0.0, the library can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the bytes written by libtiff, and Pillow does not clear the unwritten tail. An attacker can supply a crafted TIFF to an application that loads and returns or re-encodes its pixels.

In Pillow prior to 13.0.0, the TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read.

In Pillow from 5.1.0 until 13.0.0, the library can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact repeated-offset guard, so deep or cyclic page trees and long chains of unique trailer offsets can exhaust the Python stack. An attacker can supply such a PDF to an application that calls Image.save with PDF append enabled.

In Pillow from 5.1.0 until 13.0.0, reserving PDF object identifiers when saving many frames with save_all enabled takes quadratic time. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF.

In Pillow from 10.0.0 until 13.0.0, the library can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width.

In Pillow from 4.1.0 until 13.0.0, the MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels.

Pillow from 9.2.0 until 13.0.0 performs quadratic copying when saving a GIF with a long comment. _get_global_header() repeatedly copies portions of comment data, including comments from an untrusted input image, which can consume excessive CPU.

In Pillow from 5.1.0 until 13.0.0, the library can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to that PDF.

In Pillow from 12.0.0 until 13.0.0, Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC file can reach this path when an application opens and loads it, or a caller can invoke Image.merge() directly with such a first band.

In Pillow from 8.1.0 until 13.0.0, the TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not verify that the required input row fits inside the row libtiff produced (the strip path has this validation). Loading pixels from such a crafted TIFF can expose adjacent heap data in output pixels or crash the process.

Pillow before version 13.0.0 can double free image memory when ImagingScaleAffine encounters a selective allocation failure. This affects the fast path for Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with default NEAREST resampling. An attacker can trigger the failure by driving a large Image.transform() operation under memory pressure.

Pillow from 5.4.0 until 13.0.0 performs quadratic copying while parsing GIF comments. GifImageFile._seek() repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open().

Pillow from 9.2.0 until 13.0.0 can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and continues processing the same image object, later seek or load operations allocate according to those dimensions and can exhaust memory, denying service.

Pillow from 8.1.0 until 13.0.0 can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and background disposal or first-frame OP_PREVIOUS reaches PngImageFile._seek while Image.open() positions frame zero. The full-canvas allocation occurs inside Image.open() without requiring pixel loading or frame iteration, which can exhaust memory and deny service.

Pillow before version 13.0.0's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[width - 1] without rejecting that geometry. An attacker can supply such an image to an application that applies a morphology operation, causing a process crash.

Pillow from 11.3.0 until 13.0.0 has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. The error path frees the output buffer without closing the TIFF handle, and later cleanup flushes through the write callback into freed memory.

Pillow before version 13.0.0's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter is never reached. An attacker can supply or cause creation of a zero-size image to an application that applies a rank, median, minimum, or maximum filter, causing a native process crash.

Pillow from 8.2.0 until 13.0.0 can read past the tile buffer while copying four-byte pixels in the tiled-TIFF decoder. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-copy loop walks beyond that allocation.

Pillow (Python imaging library) before 13.0.0 has raw decoders P;2L and P;4L that can read past the end of an input buffer. A mismatch between the calculated packed-pixel row size and the unpacker's actual footprint can disclose up to three adjacent heap bytes in output pixels or crash the process.

Pillow from 5.1.0 until 13.0.0 allows PdfParser.get_value() to recurse without limit when reading nested PDF objects. An attacker can supply a deeply nested PDF to an application saving an image with PDF append enabled, causing an uncaught RecursionError or worker termination.

Pillow versions from 7.2.0 until 13.0.0 can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances. When an application with olefile installed reads n_frames or saves all frames from a crafted MIC file, the non-advancing traversal can hold a worker at full CPU indefinitely.

In the Pillow Python imaging library, versions 5.1.0 through 12.3.0, the PdfParser.PdfStream.decode() function calls zlib.decompress() with a buffer size set to the PDF stream Length field without bounding the decompressed output size. This allows a crafted FlateDecode PDF stream to exhaust memory from a small file.

The Pillow library (Python Imaging Library) before version 12.3.0 contains a heap out-of-bounds write vulnerability in the public rank-filter API. Providing a very large odd filter size causes overflow in image dimension calculations.

A vulnerability in the Pillow Python imaging library allows controlled native heap corruption via the ImageCms.ImageCmsTransform.apply(im, imOut) API when the output image mode does not match the declared transform output mode. This issue is fixed in version 12.3.0.

Vulnerability in Pillow (versions 8.2.0 through 12.2.0) causes excessive memory usage when decoding a crafted tiled JPEG2000 file, potentially leading to denial of service (OOM).

Pillow library versions 12.0.0 through 12.2.0 have a vulnerability in the EPS parser (PIL/EpsImagePlugin.py) that allows an infinite loop via a crafted EPS file with a negative byte count in the %%BeginBinary directive. An attacker can exploit this to cause a denial of service (DoS) when opening a malicious file with Image.open().

A vulnerability in the Pillow Python imaging library allows a native heap out-of-bounds write when processing image coordinates near signed 32-bit integer limits in Image.paste(), Image.crop(), and Image.alpha_composite(). The issue is fixed in version 12.3.0.

In Pillow library versions 5.2.0 through 12.3.0, a vulnerability exists in the TGA RLE encoder. When saving a mode 1 image with RLE compression, the encoder reads past its packed row buffer, causing adjacent process heap bytes to be copied into the generated TGA file. The issue is fixed in version 12.3.0.