# pillow (PyPI) vulnerabilities Source: https://junglewise.ai/threats/technologies/pillow Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 01:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/pillow.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 125 vulnerabilities in pillow (PyPI): 2 in the last 7 days and 43 in the last 90 days, 6 of them critical and 1 exploited in the wild. The most recent, CVE-2026-128067, was published on 13 November 2026. 41 vulnerabilities in the last four weeks, up from none in the four before. 5 critical against 0. ## Counts - Last 7 days: 2 - Last 30 days: 43 - Last 90 days: 43 - All time: 125 (6 critical, 1 exploited in the wild) ## About pillow (PyPI) Python library for opening, manipulating, and saving images. ## Latest pillow (PyPI) vulnerabilities - [CVE-2026-128067: Pillow heap buffer overflow in TIFF encoder with mismatched geometry tags](https://junglewise.ai/threats/cve-2026-128067-pillow-heap-buffer-overflow-saving-tiff-with-libtiff-when-tags) (high, published 13 Nov 2026) - [CVE-2026-128066: Pillow memory denial of service in TIFF and EXIF parsing](https://junglewise.ai/threats/cve-2026-128066-pillow-memory-dos-in-tiff-and-exif-ifd-parsing-via-overlapping) (medium, published 13 Nov 2026) - [CVE-2026-112902: Pillow libtiff encoder memory disclosure and crash via crafted TIFF tags](https://junglewise.ai/threats/cve-2026-112902-pillow-memory-disclosure-and-segfault-in-libtiff-encoder-via) (high, CVSS 4, published 5 Nov 2026) - [CVE-2026-112899: Pillow EPS load decompression bomb check bypass in Ghostscript scaling](https://junglewise.ai/threats/cve-2026-112899-pillow-eps-load-scale-lets-ghostscript-render-past-the) (medium, CVSS 4, published 5 Nov 2026) - [Pillow heap buffer overflow in bundled libopenjp2](https://junglewise.ai/threats/pillow-bundled-libopenjp2-2-5-4-in-all-wheels-since-11-1-0-carries-osv-cd00a842) (high, CVSS 8.1, published 22 Oct 2026) - [CVE-2026-114501: Pillow Arrow export memory disclosure via row padding](https://junglewise.ai/threats/cve-2026-114501-pillow-is-a-python-imaging-library-from-11-2-1-until-13-0-0) (medium, CVSS 4, published 21 Oct 2026) - [CVE-2026-96778: Pillow heap overflow in JPEG encoding with ICC profile](https://junglewise.ai/threats/cve-2026-96778-pillow-is-a-python-imaging-library-from-9-4-0-until-13-0-0) (high, CVSS 4, published 21 Oct 2026) - [CVE-2026-96644: Pillow heap buffer over-read in WMF image handler on Windows](https://junglewise.ai/threats/cve-2026-96644-pillow-is-a-python-imaging-library-prior-to-13-0-0-on-windows-src) (high, CVSS 4, published 21 Oct 2026) - [CVE-2026-96643: Pillow quadratic CPU work in EXIF parsing](https://junglewise.ai/threats/cve-2026-96643-pillow-is-a-python-imaging-library-from-11-0-0-until-13-0-0-exif) (high, CVSS 4, published 21 Oct 2026) - [CVE-2026-96642: Pillow infinite loop in TarIO with negative octal member size](https://junglewise.ai/threats/cve-2026-96642-pillow-is-a-python-imaging-library-prior-to-13-0-0-the-tario) (high, CVSS 4, published 21 Oct 2026) - [CVE-2026-96641: Pillow signed integer overflow in PILfont text-width accumulation](https://junglewise.ai/threats/cve-2026-96641-pillow-is-a-python-imaging-library-prior-to-13-0-0-pilfont-text) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-96640: Pillow PDF parser DoS via duplicate page references](https://junglewise.ai/threats/cve-2026-96640-pillow-is-a-python-imaging-library-from-5-1-0-until-13-0-0) (high, CVSS 4, published 21 Oct 2026) - [CVE-2026-96639: Pillow out-of-bounds write in multi-frame image loaders](https://junglewise.ai/threats/cve-2026-96639-pillow-is-a-python-imaging-library-from-11-0-0-until-13-0-0-multi) (critical, CVSS 9.8, published 21 Oct 2026) - [CVE-2026-96638: Pillow BMP RLE decoder memory exhaustion](https://junglewise.ai/threats/cve-2026-96638-pillow-is-a-python-imaging-library-from-9-1-0-until-13-0-0) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-96637: Pillow memory exhaustion via SPIDER image mode F frame](https://junglewise.ai/threats/cve-2026-96637-pillow-is-a-python-imaging-library-prior-to-13-0-0) (high, CVSS 4, published 21 Oct 2026) - [CVE-2026-96636: Pillow memory exhaustion via multi-frame image decompression bomb](https://junglewise.ai/threats/cve-2026-96636-pillow-is-a-python-imaging-library-prior-to-13-0-0-mpoimagefile) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-112901: Pillow XBM header regular-expression denial of service](https://junglewise.ai/threats/cve-2026-112901-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s-xbm) (medium, CVSS 4, published 19 Oct 2026) - [CVE-2026-112900: Pillow argument injection in Ghostscript EPS processing](https://junglewise.ai/threats/cve-2026-112900-pillow-is-a-python-imaging-library-from-2-6-0-until-13-0-0) (critical, CVSS 4, published 19 Oct 2026) - [CVE-2026-112898: Pillow information disclosure in quantize with empty palette](https://junglewise.ai/threats/cve-2026-112898-pillow-is-a-python-imaging-library-from-9-1-0-until-13-0-0) (medium, CVSS 4, published 19 Oct 2026) - [CVE-2026-112897: Pillow uninitialized memory disclosure in TIFF decoding](https://junglewise.ai/threats/cve-2026-112897-pillow-is-a-python-imaging-library-from-5-3-0-until-13-0-0) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112896: Pillow TIFF encoder buffer over-read in ColorMap](https://junglewise.ai/threats/cve-2026-112896-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s-tiff) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112895: Pillow PDF parser resource exhaustion in append operation](https://junglewise.ai/threats/cve-2026-112895-pillow-is-a-python-imaging-library-from-5-1-0-until-13-0-0) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112894: Pillow quadratic time PDF object identifier reservation denial of service](https://junglewise.ai/threats/cve-2026-112894-pillow-is-a-python-imaging-library-from-5-1-0-until-13-0-0) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112893: Pillow use-after-free in FreeType glyph rendering with stroker](https://junglewise.ai/threats/cve-2026-112893-pillow-is-a-python-imaging-library-from-10-0-0-until-13-0-0) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112892: Pillow MSP RLE decoder memory exhaustion](https://junglewise.ai/threats/cve-2026-112892-pillow-is-a-python-imaging-library-from-4-1-0-until-13-0-0) (high, CVSS 4, published 19 Oct 2026) ## Most severe pillow (PyPI) vulnerabilities - [CVE-2023-4863: RUSTSEC-2023-0060 - libwebp: OOB write in BuildHuffmanTable](https://junglewise.ai/threats/cve-2023-4863-google-chromium-webp-heap-based-buffer-overflow-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 12 Sep 2023) - [CVE-2026-96639: Pillow out-of-bounds write in multi-frame image loaders](https://junglewise.ai/threats/cve-2026-96639-pillow-is-a-python-imaging-library-from-11-0-0-until-13-0-0-multi) (critical, CVSS 9.8, published 21 Oct 2026) - [CVE-2026-112403: Pillow JPEG decoder buffer overflow in draft scaling](https://junglewise.ai/threats/cve-2026-112403-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s-jpeg) (critical, CVSS 4, published 19 Oct 2026) - [CVE-2026-112398: Pillow FlashPix JPEG-tile decoder heap overflow](https://junglewise.ai/threats/cve-2026-112398-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s) (critical, CVSS 4, published 19 Oct 2026) - [CVE-2026-112393: Pillow heap buffer overflow in TIFF compression with BytesIO](https://junglewise.ai/threats/cve-2026-112393-pillow-is-a-python-imaging-library-from-2-0-0-until-13-0-0) (critical, CVSS 4, published 19 Oct 2026) - [CVE-2026-112900: Pillow argument injection in Ghostscript EPS processing](https://junglewise.ai/threats/cve-2026-112900-pillow-is-a-python-imaging-library-from-2-6-0-until-13-0-0) (critical, CVSS 4, published 19 Oct 2026) - [CVE-2026-59197: python-pillow Pillow heap out-of-bounds write in RankFilter](https://junglewise.ai/threats/cve-2026-59197-python-pillow-pillow-heap-out-of-bounds-write-in-rankfilter) (high, CVSS 8.2, published 14 Jul 2026) - [Pillow heap buffer overflow in bundled libopenjp2](https://junglewise.ai/threats/pillow-bundled-libopenjp2-2-5-4-in-all-wheels-since-11-1-0-carries-osv-cd00a842) (high, CVSS 8.1, published 22 Oct 2026) - [CVE-2026-42311: Pillow integer overflow and OOB write in PSD processing](https://junglewise.ai/threats/cve-2026-42311-pillow-integer-overflow-and-oob-write-in-psd-processing) (high, CVSS 7.8, published 9 May 2026) - [CVE-2026-40192: Python Pillow denial of service via FITS GZIP decompression bomb](https://junglewise.ai/threats/cve-2026-40192-python-pillow-denial-of-service-via-fits-gzip-decompression-bomb) (high, CVSS 7.5, published 15 Apr 2026) ## Vulnerabilities per week 41 vulnerabilities in the last four weeks, up from none in the four before. 5 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 39 | 5 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 2 | 0 | 0 | | 9 Nov 2026 | 2 | 0 | 0 | ## Other PyPI technologies - [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities - [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities - [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities - [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities - [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities - [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities - [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities - [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities - [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities - [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities - [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities - [exiv2 (PyPI)](https://junglewise.ai/threats/technologies/exiv2): 85 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "pillow (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/pillow, 13 November 2026.