sbomify PyPI TEA Start free

SBOM for pillow 12.1.0

Python Imaging Library (fork)

CycloneDX PEP 740 attested 60 known vulnerabilities
Requires Python
>=3.10
PyPI
pillow 12.1.0
Changelog
https://github.com/python-pillow/Pillow/releases
Documentation
https://pillow.readthedocs.io
Funding
https://tidelift.com/subscription/pkg/pypi-pillow?utm_source=pypi-pillow&utm_medium=pypi
Homepage
https://python-pillow.github.io
Mastodon
https://fosstodon.org/@pillow
Release notes
https://pillow.readthedocs.io/en/stable/releasenotes/index.html
Source
https://github.com/python-pillow/Pillow

Available SBOMs

Read from .dist-info/sboms/ in each wheel.

pillow-12.1.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp310-cp310-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp310-cp310-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp310-cp310-musllinux_1_2_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp310-cp310-musllinux_1_2_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp311-cp311-musllinux_1_2_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp311-cp311-musllinux_1_2_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp312-cp312-musllinux_1_2_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp312-cp312-musllinux_1_2_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp313-cp313-musllinux_1_2_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp313-cp313-musllinux_1_2_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp313-cp313t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp313-cp313t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp313-cp313t-musllinux_1_2_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp313-cp313t-musllinux_1_2_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp314-cp314-musllinux_1_2_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp314-cp314-musllinux_1_2_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp314-cp314t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp314-cp314t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp314-cp314t-musllinux_1_2_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-cp314-cp314t-musllinux_1_2_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-pp311-pypy311_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-pp311-pypy311_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-pp311-pypy311_pp73-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

pillow-12.1.0-pp311-pypy311_pp73-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl

Attested
Publisher: GitHub Source: python-pillow/Pillow Workflow: wheels.yml Environment: release-pypi
auditwheel.cdx.json
CycloneDX/1.4 application/vnd.cyclonedx+json 60 known vulnerabilities
Download

Known vulnerabilities

Components listed in these SBOMs, matched against the OSV database as of 2026-11-10.

Vulnerability Severity Component Fixed in
CVE-2026-112398
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
 Critical 9.8 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112403
Pillow: Heap buffer overflow in ImagingJpegDecode
 Critical 9.8 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-96639
Pillow multi-frame loaders can reuse stale native image storage after mode transitions
 Critical 9.8 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112393
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
 Critical 9.2 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112900
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
 Critical 9.2 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112404
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
 High 8.8 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112896
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
 High 8.8 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112902
Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
 High 8.8 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112397
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
 High 8.7 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112399
Pillow: APNG background disposal allocates full canvas before decompression bomb check
 High 8.7 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112400
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
 High 8.7 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112402
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
 High 8.7 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112405
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
 High 8.7 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112406
Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
 High 8.7 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112892
Pillow: MSP RLE decoder expands a tiny file into unbounded memory
 High 8.7 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112894
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
 High 8.7 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112895
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
 High 8.7 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112897
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
 High 8.7 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-40192
FITS GZIP decompression bomb in Pillow
 High 8.7 pillow 12.1.0
PyPI
 12.2.0
CVE-2026-59204
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
 High 8.7 pillow 12.1.0
PyPI
 12.3.0
CVE-2026-25990
Pillow affected by out-of-bounds write when loading PSD images
 High 8.6 pillow 12.1.0
PyPI
 12.1.1
CVE-2026-42311
Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
 High 8.6 pillow 12.1.0
PyPI
 12.2.0
CVE-2026-54058
Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
 High 8.3 pillow 12.1.0
PyPI
 12.3.0
CVE-2026-112390
Pillow: Infinite loop in MIC n_frames when the embedded TIFF
 High 8.2 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112392
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
 High 8.2 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112394
Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
 High 8.2 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112893
Pillow: Invalid free in FreeType glyph rendering when a stroker is active
 High 8.2 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-59197
Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
 High 8.2 pillow 12.1.0
PyPI
 12.3.0
CVE-2026-96640
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
 High 8.2 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-96644
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
 High 8.1 pillow 12.1.0
PyPI
 13.0.0
GHSA-78g4-xqwv-q3g8
Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()
 High 8.1 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-96778
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
 High 7.7 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112396
Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
 High 7.5 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112901
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
 High 7.5 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-54059
Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
 High 7.5 pillow 12.1.0
PyPI
 12.3.0
CVE-2026-54060
Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
 High 7.5 pillow 12.1.0
PyPI
 12.3.0
CVE-2026-55379
Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
 High 7.5 pillow 12.1.0
PyPI
 12.3.0
CVE-2026-55380
Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`
 High 7.5 pillow 12.1.0
PyPI
 12.3.0
CVE-2026-59199
Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
 High 7.5 pillow 12.1.0
PyPI
 12.3.0
CVE-2026-59200
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
 High 7.5 pillow 12.1.0
PyPI
 12.3.0
CVE-2026-59203
Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
 High 7.5 pillow 12.1.0
PyPI
 12.3.0
CVE-2026-59205
Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch
 High 7.5 pillow 12.1.0
PyPI
 12.3.0
CVE-2026-96637
Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
 High 7.1 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-96642
Pillow: TarIO negative size field causes infinite CPU-spin loop
 High 7.1 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-96643
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
 High 7.1 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112401
Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()
 Medium 6.9 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112891
Pillow: Quadratic GIF comment copying during save
 Medium 6.9 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112898
Pillow: Image.quantize() with empty palette leaks uninitialized stack memory
 Medium 6.9 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112899
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
 Medium 6.9 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112395
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
 Medium 6.5 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-59198
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
 Medium 6.5 pillow 12.1.0
PyPI
 12.3.0
CVE-2026-96636
Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
 Medium 6.5 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-96638
Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
 Medium 6.5 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-96641
Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
 Medium 6.5 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-112391
Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()
 Medium 6.3 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-114501
Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
 Medium 6.3 pillow 12.1.0
PyPI
 13.0.0
CVE-2026-42308
Pillow has an integer overflow when processing fonts
 Medium 5.5 pillow 12.1.0
PyPI
 12.2.0
CVE-2026-42309
Pillow has a heap buffer overflow with nested list coordinates
 Medium 5.5 pillow 12.1.0
PyPI
 12.2.0
CVE-2026-42310
Pillow has a PDF Parsing Trailer Infinite Loop (DoS)
 Medium 5.5 pillow 12.1.0
PyPI
 12.2.0
CVE-2026-55798
Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path
 Medium 4.5 pillow 12.1.0
PyPI
 12.3.0

Access via TEA

Use the Transparency Exchange API to fetch this SBOM programmatically:

pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/[email protected]