{"schema_version":1,"title":"Python Pillow Pillow vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 26 vulnerabilities in Python Pillow Pillow: 0 in the last 7 days and 26 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-114501, was published on 21 October 2026. 26 vulnerabilities in the last four weeks, up from none in the four before. 2 critical against 0.","url":"https://junglewise.ai/threats/technologies/python-pillow-pillow","json_url":"https://junglewise.ai/threats/technologies/python-pillow-pillow.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/python-pillow-pillow","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":14,"all_time":26,"critical":2,"exploited":0,"last_7_days":0,"last_30_days":26,"last_90_days":26,"last_365_days":26},"latest":[{"cve":"CVE-2026-114501","cvss":4,"epss":0.0037,"slug":"cve-2026-114501-pillow-is-a-python-imaging-library-from-11-2-1-until-13-0-0","title":"Pillow Arrow export memory disclosure via row padding","severity":"medium","exploited":false,"published_at":"2026-10-21T22:16:49.41+00:00","url":"https://junglewise.ai/threats/cve-2026-114501-pillow-is-a-python-imaging-library-from-11-2-1-until-13-0-0"},{"cve":"CVE-2026-96778","cvss":4,"epss":0.004,"slug":"cve-2026-96778-pillow-is-a-python-imaging-library-from-9-4-0-until-13-0-0","title":"Pillow heap overflow in JPEG encoding with ICC profile","severity":"high","exploited":false,"published_at":"2026-10-21T21:20:33.093+00:00","url":"https://junglewise.ai/threats/cve-2026-96778-pillow-is-a-python-imaging-library-from-9-4-0-until-13-0-0"},{"cve":"CVE-2026-96644","cvss":4,"epss":0.0038,"slug":"cve-2026-96644-pillow-is-a-python-imaging-library-prior-to-13-0-0-on-windows-src","title":"Pillow heap buffer over-read in WMF image handler on Windows","severity":"high","exploited":false,"published_at":"2026-10-21T21:20:32.943+00:00","url":"https://junglewise.ai/threats/cve-2026-96644-pillow-is-a-python-imaging-library-prior-to-13-0-0-on-windows-src"},{"cve":"CVE-2026-96642","cvss":4,"epss":0.0035,"slug":"cve-2026-96642-pillow-is-a-python-imaging-library-prior-to-13-0-0-the-tario","title":"Pillow infinite loop in TarIO with negative octal member size","severity":"high","exploited":false,"published_at":"2026-10-21T21:20:32.65+00:00","url":"https://junglewise.ai/threats/cve-2026-96642-pillow-is-a-python-imaging-library-prior-to-13-0-0-the-tario"},{"cve":"CVE-2026-96641","cvss":6.5,"epss":0.0035,"slug":"cve-2026-96641-pillow-is-a-python-imaging-library-prior-to-13-0-0-pilfont-text","title":"Pillow signed integer overflow in PILfont text-width accumulation","severity":"medium","exploited":false,"published_at":"2026-10-21T21:20:32.5+00:00","url":"https://junglewise.ai/threats/cve-2026-96641-pillow-is-a-python-imaging-library-prior-to-13-0-0-pilfont-text"},{"cve":"CVE-2026-96640","cvss":4,"epss":0.0042,"slug":"cve-2026-96640-pillow-is-a-python-imaging-library-from-5-1-0-until-13-0-0","title":"Pillow PDF parser DoS via duplicate page references","severity":"high","exploited":false,"published_at":"2026-10-21T21:20:32.357+00:00","url":"https://junglewise.ai/threats/cve-2026-96640-pillow-is-a-python-imaging-library-from-5-1-0-until-13-0-0"},{"cve":"CVE-2026-96639","cvss":9.8,"epss":0.0066,"slug":"cve-2026-96639-pillow-is-a-python-imaging-library-from-11-0-0-until-13-0-0-multi","title":"Pillow out-of-bounds write in multi-frame image loaders","severity":"critical","exploited":false,"published_at":"2026-10-21T21:20:32.217+00:00","url":"https://junglewise.ai/threats/cve-2026-96639-pillow-is-a-python-imaging-library-from-11-0-0-until-13-0-0-multi"},{"cve":"CVE-2026-96638","cvss":6.5,"epss":0.0028,"slug":"cve-2026-96638-pillow-is-a-python-imaging-library-from-9-1-0-until-13-0-0","title":"Pillow BMP RLE decoder memory exhaustion","severity":"medium","exploited":false,"published_at":"2026-10-21T21:20:32.067+00:00","url":"https://junglewise.ai/threats/cve-2026-96638-pillow-is-a-python-imaging-library-from-9-1-0-until-13-0-0"},{"cve":"CVE-2026-96637","cvss":4,"epss":0.0037,"slug":"cve-2026-96637-pillow-is-a-python-imaging-library-prior-to-13-0-0","title":"Pillow memory exhaustion via SPIDER image mode F frame","severity":"high","exploited":false,"published_at":"2026-10-21T21:20:31.927+00:00","url":"https://junglewise.ai/threats/cve-2026-96637-pillow-is-a-python-imaging-library-prior-to-13-0-0"},{"cve":"CVE-2026-112898","cvss":4,"epss":0.0029,"slug":"cve-2026-112898-pillow-is-a-python-imaging-library-from-9-1-0-until-13-0-0","title":"Pillow information disclosure in quantize with empty palette","severity":"medium","exploited":false,"published_at":"2026-10-19T22:17:10.03+00:00","url":"https://junglewise.ai/threats/cve-2026-112898-pillow-is-a-python-imaging-library-from-9-1-0-until-13-0-0"},{"cve":"CVE-2026-112897","cvss":4,"epss":0.0029,"slug":"cve-2026-112897-pillow-is-a-python-imaging-library-from-5-3-0-until-13-0-0","title":"Pillow uninitialized memory disclosure in TIFF decoding","severity":"high","exploited":false,"published_at":"2026-10-19T22:17:09.9+00:00","url":"https://junglewise.ai/threats/cve-2026-112897-pillow-is-a-python-imaging-library-from-5-3-0-until-13-0-0"},{"cve":"CVE-2026-112896","cvss":4,"epss":0.0048,"slug":"cve-2026-112896-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s-tiff","title":"Pillow TIFF encoder buffer over-read in ColorMap","severity":"high","exploited":false,"published_at":"2026-10-19T22:17:09.76+00:00","url":"https://junglewise.ai/threats/cve-2026-112896-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s-tiff"},{"cve":"CVE-2026-112892","cvss":4,"epss":0.0029,"slug":"cve-2026-112892-pillow-is-a-python-imaging-library-from-4-1-0-until-13-0-0","title":"Pillow MSP RLE decoder memory exhaustion","severity":"high","exploited":false,"published_at":"2026-10-19T22:17:09.21+00:00","url":"https://junglewise.ai/threats/cve-2026-112892-pillow-is-a-python-imaging-library-from-4-1-0-until-13-0-0"},{"cve":"CVE-2026-112891","cvss":4,"epss":0.0037,"slug":"cve-2026-112891-pillow-is-a-python-imaging-library-from-9-2-0-until-13-0-0","title":"Pillow quadratic copying in GIF comment handling","severity":"medium","exploited":false,"published_at":"2026-10-19T22:17:08.64+00:00","url":"https://junglewise.ai/threats/cve-2026-112891-pillow-is-a-python-imaging-library-from-9-2-0-until-13-0-0"},{"cve":"CVE-2026-112406","cvss":4,"epss":0.0029,"slug":"cve-2026-112406-pillow-is-a-python-imaging-library-from-5-1-0-until-13-0-0","title":"Pillow infinite loop in PDF page rewriting","severity":"high","exploited":false,"published_at":"2026-10-19T22:17:08.153+00:00","url":"https://junglewise.ai/threats/cve-2026-112406-pillow-is-a-python-imaging-library-from-5-1-0-until-13-0-0"},{"cve":"CVE-2026-112405","cvss":4,"epss":0.0053,"slug":"cve-2026-112405-pillow-is-a-python-imaging-library-from-12-0-0-until-13-0-0","title":"Pillow null pointer dereference in Image.merge()","severity":"high","exploited":false,"published_at":"2026-10-19T22:17:08.027+00:00","url":"https://junglewise.ai/threats/cve-2026-112405-pillow-is-a-python-imaging-library-from-12-0-0-until-13-0-0"},{"cve":"CVE-2026-112404","cvss":4,"epss":0.0029,"slug":"cve-2026-112404-pillow-is-a-python-imaging-library-from-8-1-0-until-13-0-0","title":"Pillow TIFF tile and RGBA decode heap buffer over-read","severity":"high","exploited":false,"published_at":"2026-10-19T22:17:07.9+00:00","url":"https://junglewise.ai/threats/cve-2026-112404-pillow-is-a-python-imaging-library-from-8-1-0-until-13-0-0"},{"cve":"CVE-2026-112401","cvss":4,"epss":0.0037,"slug":"cve-2026-112401-pillow-is-a-python-imaging-library-from-5-4-0-until-13-0-0","title":"Pillow quadratic copying in GIF comment parsing","severity":"medium","exploited":false,"published_at":"2026-10-19T22:17:07.503+00:00","url":"https://junglewise.ai/threats/cve-2026-112401-pillow-is-a-python-imaging-library-from-5-4-0-until-13-0-0"},{"cve":"CVE-2026-112399","cvss":4,"epss":0.0029,"slug":"cve-2026-112399-pillow-is-a-python-imaging-library-from-8-1-0-until-13-0-0","title":"Pillow APNG decompression bomb denial of service","severity":"high","exploited":false,"published_at":"2026-10-19T22:17:07.24+00:00","url":"https://junglewise.ai/threats/cve-2026-112399-pillow-is-a-python-imaging-library-from-8-1-0-until-13-0-0"},{"cve":"CVE-2026-112398","cvss":4,"epss":0.007,"slug":"cve-2026-112398-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s","title":"Pillow FlashPix JPEG-tile decoder heap overflow","severity":"critical","exploited":false,"published_at":"2026-10-19T22:17:07.107+00:00","url":"https://junglewise.ai/threats/cve-2026-112398-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s"},{"cve":"CVE-2026-112397","cvss":4,"epss":0.0057,"slug":"cve-2026-112397-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s","title":"Pillow buffer underflow in ImageMorph.MorphOp.apply","severity":"high","exploited":false,"published_at":"2026-10-19T22:17:06.97+00:00","url":"https://junglewise.ai/threats/cve-2026-112397-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s"},{"cve":"CVE-2026-112396","cvss":5.9,"epss":0.0069,"slug":"cve-2026-112396-pillow-is-a-python-imaging-library-from-11-3-0-until-13-0-0","title":"Pillow heap use-after-free in TIFF encoding","severity":"medium","exploited":false,"published_at":"2026-10-19T22:17:06.837+00:00","url":"https://junglewise.ai/threats/cve-2026-112396-pillow-is-a-python-imaging-library-from-11-3-0-until-13-0-0"},{"cve":"CVE-2026-112395","cvss":6.5,"epss":0.0026,"slug":"cve-2026-112395-pillow-is-a-python-imaging-library-from-8-2-0-until-13-0-0","title":"Pillow tiled-TIFF decoder heap buffer overread","severity":"medium","exploited":false,"published_at":"2026-10-19T21:17:07.88+00:00","url":"https://junglewise.ai/threats/cve-2026-112395-pillow-is-a-python-imaging-library-from-8-2-0-until-13-0-0"},{"cve":"CVE-2026-112394","cvss":4,"epss":0.0056,"slug":"cve-2026-112394-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s-p-2l","title":"Pillow buffer over-read in P;2L and P;4L raw decoders","severity":"medium","exploited":false,"published_at":"2026-10-19T21:17:07.747+00:00","url":"https://junglewise.ai/threats/cve-2026-112394-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s-p-2l"},{"cve":"CVE-2026-112391","cvss":4,"epss":0.0029,"slug":"cve-2026-112391-pillow-is-a-python-imaging-library-from-5-1-0-until-13-0-0","title":"Pillow infinite recursion in PDF parser","severity":"medium","exploited":false,"published_at":"2026-10-19T21:17:07.477+00:00","url":"https://junglewise.ai/threats/cve-2026-112391-pillow-is-a-python-imaging-library-from-5-1-0-until-13-0-0"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":2,"exploited":0,"vulnerabilities":26},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Python Pillow Pillow","slug":"python-pillow-pillow","vendor":{"hub":true,"name":"Python Pillow","slug":"python-pillow","url":"https://junglewise.ai/threats/vendors/python-pillow"},"aliases":[],"category":"library","homepage":"https://python-pillow.org","description":"Python library for image processing and manipulation.","url":"https://junglewise.ai/threats/technologies/python-pillow-pillow"},"most_severe":[{"cve":"CVE-2026-96639","cvss":9.8,"epss":0.0066,"slug":"cve-2026-96639-pillow-is-a-python-imaging-library-from-11-0-0-until-13-0-0-multi","title":"Pillow out-of-bounds write in multi-frame image loaders","severity":"critical","exploited":false,"published_at":"2026-10-21T21:20:32.217+00:00","url":"https://junglewise.ai/threats/cve-2026-96639-pillow-is-a-python-imaging-library-from-11-0-0-until-13-0-0-multi"},{"cve":"CVE-2026-112398","cvss":4,"epss":0.007,"slug":"cve-2026-112398-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s","title":"Pillow FlashPix JPEG-tile decoder heap overflow","severity":"critical","exploited":false,"published_at":"2026-10-19T22:17:07.107+00:00","url":"https://junglewise.ai/threats/cve-2026-112398-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s"},{"cve":"CVE-2026-112397","cvss":4,"epss":0.0057,"slug":"cve-2026-112397-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s","title":"Pillow buffer underflow in ImageMorph.MorphOp.apply","severity":"high","exploited":false,"published_at":"2026-10-19T22:17:06.97+00:00","url":"https://junglewise.ai/threats/cve-2026-112397-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s"},{"cve":"CVE-2026-112405","cvss":4,"epss":0.0053,"slug":"cve-2026-112405-pillow-is-a-python-imaging-library-from-12-0-0-until-13-0-0","title":"Pillow null pointer dereference in Image.merge()","severity":"high","exploited":false,"published_at":"2026-10-19T22:17:08.027+00:00","url":"https://junglewise.ai/threats/cve-2026-112405-pillow-is-a-python-imaging-library-from-12-0-0-until-13-0-0"},{"cve":"CVE-2026-112896","cvss":4,"epss":0.0048,"slug":"cve-2026-112896-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s-tiff","title":"Pillow TIFF encoder buffer over-read in ColorMap","severity":"high","exploited":false,"published_at":"2026-10-19T22:17:09.76+00:00","url":"https://junglewise.ai/threats/cve-2026-112896-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s-tiff"},{"cve":"CVE-2026-96640","cvss":4,"epss":0.0042,"slug":"cve-2026-96640-pillow-is-a-python-imaging-library-from-5-1-0-until-13-0-0","title":"Pillow PDF parser DoS via duplicate page references","severity":"high","exploited":false,"published_at":"2026-10-21T21:20:32.357+00:00","url":"https://junglewise.ai/threats/cve-2026-96640-pillow-is-a-python-imaging-library-from-5-1-0-until-13-0-0"},{"cve":"CVE-2026-96778","cvss":4,"epss":0.004,"slug":"cve-2026-96778-pillow-is-a-python-imaging-library-from-9-4-0-until-13-0-0","title":"Pillow heap overflow in JPEG encoding with ICC profile","severity":"high","exploited":false,"published_at":"2026-10-21T21:20:33.093+00:00","url":"https://junglewise.ai/threats/cve-2026-96778-pillow-is-a-python-imaging-library-from-9-4-0-until-13-0-0"},{"cve":"CVE-2026-96644","cvss":4,"epss":0.0038,"slug":"cve-2026-96644-pillow-is-a-python-imaging-library-prior-to-13-0-0-on-windows-src","title":"Pillow heap buffer over-read in WMF image handler on Windows","severity":"high","exploited":false,"published_at":"2026-10-21T21:20:32.943+00:00","url":"https://junglewise.ai/threats/cve-2026-96644-pillow-is-a-python-imaging-library-prior-to-13-0-0-on-windows-src"},{"cve":"CVE-2026-96637","cvss":4,"epss":0.0037,"slug":"cve-2026-96637-pillow-is-a-python-imaging-library-prior-to-13-0-0","title":"Pillow memory exhaustion via SPIDER image mode F frame","severity":"high","exploited":false,"published_at":"2026-10-21T21:20:31.927+00:00","url":"https://junglewise.ai/threats/cve-2026-96637-pillow-is-a-python-imaging-library-prior-to-13-0-0"},{"cve":"CVE-2026-96642","cvss":4,"epss":0.0035,"slug":"cve-2026-96642-pillow-is-a-python-imaging-library-prior-to-13-0-0-the-tario","title":"Pillow infinite loop in TarIO with negative octal member size","severity":"high","exploited":false,"published_at":"2026-10-21T21:20:32.65+00:00","url":"https://junglewise.ai/threats/cve-2026-96642-pillow-is-a-python-imaging-library-prior-to-13-0-0-the-tario"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}