en
python-pillow is the open-source project and maintainer community for Pillow, a Python Imaging Library fork. It provides image opening, editing, conversion, and saving capabilities with support for many file formats, delivered primarily as a Python package for developers building desktop, server, automation, and data-processing applications. The project has a global contributor community.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-54058Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)CVE-2026-59197Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`CVE-2026-59200Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()CVE-2026-59198Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated imagesCVE-2026-59205Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-54058Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files) | Exploitation statusActively exploited | FixYes |
| Affected productPillow |
| Published07/14/2026 |
| SeverityHigh |
CVE-2026-59197Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand` | Exploitation statusActively exploited | FixYes | Affected productPillow | Published07/14/2026 | SeverityHigh |
|---|
CVE-2026-59200Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode() | Exploitation statusActively exploited | FixYes | Affected productPillow | Published07/14/2026 | SeverityHigh |
|---|
CVE-2026-59198Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images | Exploitation statusActively exploited | FixYes | Affected productPillow | Published07/14/2026 | SeverityMedium |
|---|
CVE-2026-59205Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch | Exploitation statusActively exploited | FixYes | Affected productPillow | Published07/14/2026 | SeverityHigh |
|---|
CVE-2026-59203Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service | Exploitation statusActively exploited | FixYes | Affected productPillow | Published07/14/2026 | SeverityMedium |
|---|
CVE-2026-59199Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow | Exploitation statusActively exploited | FixYes | Affected productPillow | Published07/14/2026 | SeverityHigh |
|---|
CVE-2026-59204Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service | Exploitation statusActively exploited | FixYes | Affected productPillow | Published07/14/2026 | SeverityHigh |
|---|
CVE-2026-55379Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading | Exploitation statusActively exploited | FixYes | Affected productPillow | Published07/06/2026 | SeverityHigh |
|---|
CVE-2026-55380Pillow GdImageFile decompression bomb protection bypass | Exploitation statusActively exploited | FixYes | Affected productPillow | Published07/06/2026 | SeverityHigh |
|---|
20 Results | Page 1 of 2