# SBOM for pillow 12.1.0

> Python Imaging Library (fork)

The Python package pillow 12.1.0 ships 46 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.

- Package URL (PURL): `pkg:pypi/pillow@12.1.0`
- PyPI: https://pypi.org/project/pillow/12.1.0/
- Requires Python: \>=3.10
- Changelog: <https://github.com/python-pillow/Pillow/releases>
- Documentation: <https://pillow.readthedocs.io>
- Funding: <https://tidelift.com/subscription/pkg/pypi-pillow?utm_source=pypi-pillow&utm_medium=pypi>
- Homepage: <https://python-pillow.github.io>
- Mastodon: <https://fosstodon.org/@pillow>
- Release notes: <https://pillow.readthedocs.io/en/stable/releasenotes/index.html>
- Source: <https://github.com/python-pillow/Pillow>

## SBOMs

### pillow-12.1.0-cp310-cp310-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/ee4e078a-0343-5ecc-9322-b67f36f9655c/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp310-cp310-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/bbeeaa80-f36d-540e-8f74-ac79ae96273c/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp310-cp310-manylinux\_2\_27\_aarch64.manylinux\_2\_28\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/fa0d838a-9d0a-5c41-ba38-e03c21b1e8f2/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp310-cp310-manylinux\_2\_27\_x86\_64.manylinux\_2\_28\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/23cdef38-8099-57c0-809b-1f6b21440d4a/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp310-cp310-musllinux\_1\_2\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/be867d9b-65c0-5ac1-a865-67e3b1784122/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp310-cp310-musllinux\_1\_2\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/aa2250ff-351e-5703-b2ef-ed04d9ebcabb/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp311-cp311-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/53ede5eb-fb1e-56eb-9d6a-7790f8abcba4/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp311-cp311-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/546c65e1-9541-5614-88d5-a08b2824b85a/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp311-cp311-manylinux\_2\_27\_aarch64.manylinux\_2\_28\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/58ad8fd8-7b61-5ca7-8781-0aad045eb871/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp311-cp311-manylinux\_2\_27\_x86\_64.manylinux\_2\_28\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/994a8d0a-924e-5ac4-afa4-63f2e64d6fc7/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp311-cp311-musllinux\_1\_2\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/13f203ef-b5fd-51a5-a94b-e4408b5d5b0f/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp311-cp311-musllinux\_1\_2\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/d2e4c614-cd5f-502c-b1bd-df5c65737fc8/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp312-cp312-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/5766274a-87cc-5abf-a0f2-a16e32348314/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp312-cp312-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/f085dd75-aad6-5b93-8c12-b52d427796be/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp312-cp312-manylinux\_2\_27\_aarch64.manylinux\_2\_28\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/f850fceb-40e8-5278-bd10-30739f59235c/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp312-cp312-manylinux\_2\_27\_x86\_64.manylinux\_2\_28\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/09ecd097-72f5-5e3e-824b-02afca778361/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp312-cp312-musllinux\_1\_2\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/34a2e547-a18d-5d19-bac0-eba59495746c/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp312-cp312-musllinux\_1\_2\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/2bdbd1e0-954e-5129-8b77-82ff81bd93d1/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp313-cp313-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/6bdd2080-f37d-5fd4-9d02-172883181def/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp313-cp313-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/37e6e0e5-a926-54a7-8e23-3e502ee6d23f/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp313-cp313-manylinux\_2\_27\_aarch64.manylinux\_2\_28\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/6fccd8ff-f005-5135-9fa0-648859e6c35e/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp313-cp313-manylinux\_2\_27\_x86\_64.manylinux\_2\_28\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/2b27085a-57c0-5f3b-930a-f3706164de77/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp313-cp313-musllinux\_1\_2\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/be606c4f-41a9-5871-9c7e-e1fed0b570a2/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp313-cp313-musllinux\_1\_2\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/6fe32412-bdb8-58d4-8ce6-dbee68b9ce02/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp313-cp313t-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/f580a3a4-69e5-5532-9477-97a99f3e4c6b/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp313-cp313t-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/f3e8c785-5ebf-5725-aff5-fecf82f02f70/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp313-cp313t-manylinux\_2\_27\_aarch64.manylinux\_2\_28\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/bdf49ade-746b-5eac-8385-53e2ea184b3f/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp313-cp313t-manylinux\_2\_27\_x86\_64.manylinux\_2\_28\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/9a8944f9-a706-5935-9da6-b98c12259004/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp313-cp313t-musllinux\_1\_2\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/2307f671-d524-5168-af26-1b1066e13825/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp313-cp313t-musllinux\_1\_2\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/cc84c62c-aeba-5dc5-82ff-a90c4dd321f9/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp314-cp314-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/bf20e643-c484-5a33-80ad-230af5c10ff1/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp314-cp314-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/59c87c8d-7c48-5401-b770-dee7ab38f261/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp314-cp314-manylinux\_2\_27\_aarch64.manylinux\_2\_28\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/6adbaa34-7992-5873-9b27-c4031d11c024/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp314-cp314-manylinux\_2\_27\_x86\_64.manylinux\_2\_28\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/dc462f90-84de-5089-a0e2-4a315cf867b4/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp314-cp314-musllinux\_1\_2\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/0dabc863-62fc-5730-b3bc-d78ce4ce95c6/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp314-cp314-musllinux\_1\_2\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/44663735-4c41-5212-b2af-be9197f1c105/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp314-cp314t-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/82cd6e36-93f3-5c7f-bf46-dcfdfa4b847d/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp314-cp314t-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/4404fae4-c4aa-5e47-b224-2d3c6f9f22ea/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp314-cp314t-manylinux\_2\_27\_aarch64.manylinux\_2\_28\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/ea1d4f4d-1d74-5d83-8c50-42524f6c2d00/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp314-cp314t-manylinux\_2\_27\_x86\_64.manylinux\_2\_28\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/56c95a98-5638-502b-833a-49959e7e57c0/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp314-cp314t-musllinux\_1\_2\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/d3130d2c-7153-533e-ab90-7b999e17a86d/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-cp314-cp314t-musllinux\_1\_2\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/c72ee50b-17bc-5c52-87b6-f4e7133f1fb9/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-pp311-pypy311\_pp73-manylinux2014\_aarch64.manylinux\_2\_17\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/f15cd0a8-f1cb-5680-9f28-e854ee7b9801/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-pp311-pypy311\_pp73-manylinux2014\_x86\_64.manylinux\_2\_17\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/2994a44c-d554-5fd9-8655-ee0d9797cc7d/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-pp311-pypy311\_pp73-manylinux\_2\_27\_aarch64.manylinux\_2\_28\_aarch64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/58295a43-e06e-5365-a939-a167950ad607/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

### pillow-12.1.0-pp311-pypy311\_pp73-manylinux\_2\_27\_x86\_64.manylinux\_2\_28\_x86\_64.whl

PEP 740 attestation verified (GitHub, python-pillow/Pillow, workflow wheels.yml).

- [pillow-12.1.0.dist-info/sboms/auditwheel.cdx.json](https://pypi.sbomify.com/artifact/937d940a-5c4e-567f-9f8d-83b434135599/download): CycloneDX/1.4, `application/vnd.cyclonedx+json`, valid, 60 known vulnerabilities

## Known vulnerabilities

Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.

| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [CVE-2026-112398](https://insights.sbomify.com/CVE-2026-112398/) | critical (9.8) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution |
| [CVE-2026-112403](https://insights.sbomify.com/CVE-2026-112403/) | critical (9.8) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Heap buffer overflow in ImagingJpegDecode |
| [CVE-2026-96639](https://insights.sbomify.com/CVE-2026-96639/) | critical (9.8) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow multi-frame loaders can reuse stale native image storage after mode transitions |
| [CVE-2026-112393](https://insights.sbomify.com/CVE-2026-112393/) | critical (9.2) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Heap buffer overflow in \_tiffWriteProc when saving TIFF to BytesIO |
| [CVE-2026-112900](https://insights.sbomify.com/CVE-2026-112900/) | critical (9.2) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Argument Injection in Ghostscript call, potentially leading into RCE |
| [CVE-2026-112404](https://insights.sbomify.com/CVE-2026-112404/) | high (8.8) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels |
| [CVE-2026-112896](https://insights.sbomify.com/CVE-2026-112896/) | high (8.8) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read |
| [CVE-2026-112902](https://insights.sbomify.com/CVE-2026-112902/) | high (8.8) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags |
| [CVE-2026-112397](https://insights.sbomify.com/CVE-2026-112397/) | high (8.7) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Out-of-bounds access in \_imagingmorph on a zero-width image |
| [CVE-2026-112399](https://insights.sbomify.com/CVE-2026-112399/) | high (8.7) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: APNG background disposal allocates full canvas before decompression bomb check |
| [CVE-2026-112400](https://insights.sbomify.com/CVE-2026-112400/) | high (8.7) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS |
| [CVE-2026-112402](https://insights.sbomify.com/CVE-2026-112402/) | high (8.7) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform |
| [CVE-2026-112405](https://insights.sbomify.com/CVE-2026-112405/) | high (8.7) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0 |
| [CVE-2026-112406](https://insights.sbomify.com/CVE-2026-112406/) | high (8.7) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Infinite loop in PdfParser.rewrite\_pages on page tree Parent cycle |
| [CVE-2026-112892](https://insights.sbomify.com/CVE-2026-112892/) | high (8.7) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: MSP RLE decoder expands a tiny file into unbounded memory |
| [CVE-2026-112894](https://insights.sbomify.com/CVE-2026-112894/) | high (8.7) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Quadratic-time DoS in PDF save\_all (PdfParser.next\_object\_id) |
| [CVE-2026-112895](https://insights.sbomify.com/CVE-2026-112895/) | high (8.7) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310) |
| [CVE-2026-112897](https://insights.sbomify.com/CVE-2026-112897/) | high (8.7) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips |
| [CVE-2026-40192](https://insights.sbomify.com/CVE-2026-40192/) | high (8.7) | pillow 12.1.0 (PyPI) | 12.2.0 | FITS GZIP decompression bomb in Pillow |
| [CVE-2026-59204](https://insights.sbomify.com/CVE-2026-59204/) | high (8.7) | pillow 12.1.0 (PyPI) | 12.3.0 | Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service |
| [CVE-2026-25990](https://insights.sbomify.com/CVE-2026-25990/) | high (8.6) | pillow 12.1.0 (PyPI) | 12.1.1 | Pillow affected by out-of-bounds write when loading PSD images |
| [CVE-2026-42311](https://insights.sbomify.com/CVE-2026-42311/) | high (8.6) | pillow 12.1.0 (PyPI) | 12.2.0 | Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow) |
| [CVE-2026-54058](https://insights.sbomify.com/CVE-2026-54058/) | high (8.3) | pillow 12.1.0 (PyPI) | 12.3.0 | Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files) |
| [CVE-2026-112390](https://insights.sbomify.com/CVE-2026-112390/) | high (8.2) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Infinite loop in MIC n\_frames when the embedded TIFF |
| [CVE-2026-112392](https://insights.sbomify.com/CVE-2026-112392/) | high (8.2) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images |
| [CVE-2026-112394](https://insights.sbomify.com/CVE-2026-112394/) | high (8.2) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size |
| [CVE-2026-112893](https://insights.sbomify.com/CVE-2026-112893/) | high (8.2) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Invalid free in FreeType glyph rendering when a stroker is active |
| [CVE-2026-59197](https://insights.sbomify.com/CVE-2026-59197/) | high (8.2) | pillow 12.1.0 (PyPI) | 12.3.0 | Pillow: Heap out-of-bounds write in \`ImageFilter.RankFilter\` via integer overflow in \`ImagingExpand\` |
| [CVE-2026-96640](https://insights.sbomify.com/CVE-2026-96640/) | high (8.2) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion |
| [CVE-2026-96644](https://insights.sbomify.com/CVE-2026-96644/) | high (8.1) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds) |
| [GHSA-78g4-xqwv-q3g8](https://osv.dev/vulnerability/GHSA-78g4-xqwv-q3g8) | high (8.1) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load() |
| [CVE-2026-96778](https://insights.sbomify.com/CVE-2026-96778/) | high (7.7) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer |
| [CVE-2026-112396](https://insights.sbomify.com/CVE-2026-112396/) | high (7.5) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer |
| [CVE-2026-112901](https://insights.sbomify.com/CVE-2026-112901/) | high (7.5) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes |
| [CVE-2026-54059](https://insights.sbomify.com/CVE-2026-54059/) | high (7.5) | pillow 12.1.0 (PyPI) | 12.3.0 | Pillow \`PcfFontFile.\_load\_bitmaps()\`: \`Image.frombytes()\` called without \`\_decompression\_bomb\_check()\` — bomb protection bypass via PCF font loading |
| [CVE-2026-54060](https://insights.sbomify.com/CVE-2026-54060/) | high (7.5) | pillow 12.1.0 (PyPI) | 12.3.0 | Pillow: \`FontFile.compile()\`: \`Image.new()\` called without \`\_decompression\_bomb\_check()\` |
| [CVE-2026-55379](https://insights.sbomify.com/CVE-2026-55379/) | high (7.5) | pillow 12.1.0 (PyPI) | 12.3.0 | Pillow \`BdfFontFile\`: \`Image.new()\` called without \`\_decompression\_bomb\_check()\` — bomb protection bypass via font loading |
| [CVE-2026-55380](https://insights.sbomify.com/CVE-2026-55380/) | high (7.5) | pillow 12.1.0 (PyPI) | 12.3.0 | Pillow \`GdImageFile.\_open()\`: image dimensions accepted without \`\_decompression\_bomb\_check()\` |
| [CVE-2026-59199](https://insights.sbomify.com/CVE-2026-59199/) | high (7.5) | pillow 12.1.0 (PyPI) | 12.3.0 | Pillow: Heap out-of-bounds write \`Image.paste()\` / \`Image.crop()\` via signed coordinate overflow |
| [CVE-2026-59200](https://insights.sbomify.com/CVE-2026-59200/) | high (7.5) | pillow 12.1.0 (PyPI) | 12.3.0 | Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode() |
| [CVE-2026-59203](https://insights.sbomify.com/CVE-2026-59203/) | high (7.5) | pillow 12.1.0 (PyPI) | 12.3.0 | Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service |
| [CVE-2026-59205](https://insights.sbomify.com/CVE-2026-59205/) | high (7.5) | pillow 12.1.0 (PyPI) | 12.3.0 | Pillow: Controlled heap out-of-bounds write in Pillow \`ImageCmsTransform.apply()\` via output mode mismatch |
| [CVE-2026-96637](https://insights.sbomify.com/CVE-2026-96637/) | high (7.1) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS |
| [CVE-2026-96642](https://insights.sbomify.com/CVE-2026-96642/) | high (7.1) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: TarIO negative size field causes infinite CPU-spin loop |
| [CVE-2026-96643](https://insights.sbomify.com/CVE-2026-96643/) | high (7.1) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time |
| [CVE-2026-112401](https://insights.sbomify.com/CVE-2026-112401/) | medium (6.9) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Quadratic GIF comment concatenation allows DoS in Image.open() |
| [CVE-2026-112891](https://insights.sbomify.com/CVE-2026-112891/) | medium (6.9) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Quadratic GIF comment copying during save |
| [CVE-2026-112898](https://insights.sbomify.com/CVE-2026-112898/) | medium (6.9) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Image.quantize() with empty palette leaks uninitialized stack memory |
| [CVE-2026-112899](https://insights.sbomify.com/CVE-2026-112899/) | medium (6.9) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit |
| [CVE-2026-112395](https://insights.sbomify.com/CVE-2026-112395/) | medium (6.5) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290) |
| [CVE-2026-59198](https://insights.sbomify.com/CVE-2026-59198/) | medium (6.5) | pillow 12.1.0 (PyPI) | 12.3.0 | Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images |
| [CVE-2026-96636](https://insights.sbomify.com/CVE-2026-96636/) | medium (6.5) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek) |
| [CVE-2026-96638](https://insights.sbomify.com/CVE-2026-96638/) | medium (6.5) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode |
| [CVE-2026-96641](https://insights.sbomify.com/CVE-2026-96641/) | medium (6.5) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise |
| [CVE-2026-112391](https://insights.sbomify.com/CVE-2026-112391/) | medium (6.3) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: PdfParser can recurse without limit in get\_value() and linearize\_page\_tree() |
| [CVE-2026-114501](https://insights.sbomify.com/CVE-2026-114501/) | medium (6.3) | pillow 12.1.0 (PyPI) | 13.0.0 | Pillow: Arrow export leaks stale heap memory when PILLOW\_ALIGNMENT \> 1 |
| [CVE-2026-42308](https://insights.sbomify.com/CVE-2026-42308/) | medium (5.5) | pillow 12.1.0 (PyPI) | 12.2.0 | Pillow has an integer overflow when processing fonts |
| [CVE-2026-42309](https://insights.sbomify.com/CVE-2026-42309/) | medium (5.5) | pillow 12.1.0 (PyPI) | 12.2.0 | Pillow has a heap buffer overflow with nested list coordinates |
| [CVE-2026-42310](https://insights.sbomify.com/CVE-2026-42310/) | medium (5.5) | pillow 12.1.0 (PyPI) | 12.2.0 | Pillow has a PDF Parsing Trailer Infinite Loop (DoS) |
| [CVE-2026-55798](https://insights.sbomify.com/CVE-2026-55798/) | medium (4.5) | pillow 12.1.0 (PyPI) | 12.3.0 | Pillow: WindowsViewer.get\_command() OS command injection via unescaped shell path |

## Fetch it over TEA

This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:

```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/pillow@12.1.0
```

Machine-readable copy of this page: https://pypi.sbomify.com/package/pillow/12.1.0.json

---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/pillow/12.1.0