Pillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can read past the end of an input buffer. ImagingRawDecode calculates a packed-pixel row size, while the unpackers read separately padded bit planes. A caller can supply a buffer and image dimensions whose accepted size is smaller than the unpacker's actual footprint. This can disclose up to three adjacent heap bytes in output pixels or crash the process. This issue is fixed in version 13.0.0.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/python-pillow/Pillow/commit/392ee6f0d19a4adb766a63e9a99f3c28193b8d31 Patch
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-4558-3h8r-v8xp Exploit, Vendor Advisory
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-4558-3h8r-v8xp Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 6
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-26 21:01
- StatusPublished → AnalyzedNVD modified 2026-10-26 21:01
- StatusUndergoing Analysis → PublishedNVD modified 2026-10-22 21:04
- StatusPublished → Undergoing AnalysisNVD modified 2026-10-20 19:48
- StatusReceived → PublishedNVD modified 2026-10-19 20:48
- First seenCVSS 6.3NVD modified 2026-10-19 21:17
Affected (CPE criteria) 1
cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
References 4
- https://github.com/python-pillow/Pillow/commit/392ee6f0d19a4adb766a63e9a99f3c28193b8d31 Patch
- https://github.com/python-pillow/Pillow/releases/tag/13.0.0 Release Notes
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-4558-3h8r-v8xp Exploit, Vendor Advisory
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-4558-3h8r-v8xp Exploit, Vendor Advisory