# Python Pillow Pillow vulnerabilities Source: https://junglewise.ai/threats/technologies/python-pillow-pillow Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/python-pillow-pillow.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 26 vulnerabilities in Python Pillow Pillow: 0 in the last 7 days and 26 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-114501, was published on 21 October 2026. 26 vulnerabilities in the last four weeks, up from none in the four before. 2 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 26 - Last 90 days: 26 - All time: 26 (2 critical, 0 exploited in the wild) ## About Python Pillow Pillow Python library for image processing and manipulation. ## Latest Python Pillow Pillow vulnerabilities - [CVE-2026-114501: Pillow Arrow export memory disclosure via row padding](https://junglewise.ai/threats/cve-2026-114501-pillow-is-a-python-imaging-library-from-11-2-1-until-13-0-0) (medium, CVSS 4, published 21 Oct 2026) - [CVE-2026-96778: Pillow heap overflow in JPEG encoding with ICC profile](https://junglewise.ai/threats/cve-2026-96778-pillow-is-a-python-imaging-library-from-9-4-0-until-13-0-0) (high, CVSS 4, published 21 Oct 2026) - [CVE-2026-96644: Pillow heap buffer over-read in WMF image handler on Windows](https://junglewise.ai/threats/cve-2026-96644-pillow-is-a-python-imaging-library-prior-to-13-0-0-on-windows-src) (high, CVSS 4, published 21 Oct 2026) - [CVE-2026-96642: Pillow infinite loop in TarIO with negative octal member size](https://junglewise.ai/threats/cve-2026-96642-pillow-is-a-python-imaging-library-prior-to-13-0-0-the-tario) (high, CVSS 4, published 21 Oct 2026) - [CVE-2026-96641: Pillow signed integer overflow in PILfont text-width accumulation](https://junglewise.ai/threats/cve-2026-96641-pillow-is-a-python-imaging-library-prior-to-13-0-0-pilfont-text) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-96640: Pillow PDF parser DoS via duplicate page references](https://junglewise.ai/threats/cve-2026-96640-pillow-is-a-python-imaging-library-from-5-1-0-until-13-0-0) (high, CVSS 4, published 21 Oct 2026) - [CVE-2026-96639: Pillow out-of-bounds write in multi-frame image loaders](https://junglewise.ai/threats/cve-2026-96639-pillow-is-a-python-imaging-library-from-11-0-0-until-13-0-0-multi) (critical, CVSS 9.8, published 21 Oct 2026) - [CVE-2026-96638: Pillow BMP RLE decoder memory exhaustion](https://junglewise.ai/threats/cve-2026-96638-pillow-is-a-python-imaging-library-from-9-1-0-until-13-0-0) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-96637: Pillow memory exhaustion via SPIDER image mode F frame](https://junglewise.ai/threats/cve-2026-96637-pillow-is-a-python-imaging-library-prior-to-13-0-0) (high, CVSS 4, published 21 Oct 2026) - [CVE-2026-112898: Pillow information disclosure in quantize with empty palette](https://junglewise.ai/threats/cve-2026-112898-pillow-is-a-python-imaging-library-from-9-1-0-until-13-0-0) (medium, CVSS 4, published 19 Oct 2026) - [CVE-2026-112897: Pillow uninitialized memory disclosure in TIFF decoding](https://junglewise.ai/threats/cve-2026-112897-pillow-is-a-python-imaging-library-from-5-3-0-until-13-0-0) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112896: Pillow TIFF encoder buffer over-read in ColorMap](https://junglewise.ai/threats/cve-2026-112896-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s-tiff) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112892: Pillow MSP RLE decoder memory exhaustion](https://junglewise.ai/threats/cve-2026-112892-pillow-is-a-python-imaging-library-from-4-1-0-until-13-0-0) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112891: Pillow quadratic copying in GIF comment handling](https://junglewise.ai/threats/cve-2026-112891-pillow-is-a-python-imaging-library-from-9-2-0-until-13-0-0) (medium, CVSS 4, published 19 Oct 2026) - [CVE-2026-112406: Pillow infinite loop in PDF page rewriting](https://junglewise.ai/threats/cve-2026-112406-pillow-is-a-python-imaging-library-from-5-1-0-until-13-0-0) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112405: Pillow null pointer dereference in Image.merge()](https://junglewise.ai/threats/cve-2026-112405-pillow-is-a-python-imaging-library-from-12-0-0-until-13-0-0) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112404: Pillow TIFF tile and RGBA decode heap buffer over-read](https://junglewise.ai/threats/cve-2026-112404-pillow-is-a-python-imaging-library-from-8-1-0-until-13-0-0) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112401: Pillow quadratic copying in GIF comment parsing](https://junglewise.ai/threats/cve-2026-112401-pillow-is-a-python-imaging-library-from-5-4-0-until-13-0-0) (medium, CVSS 4, published 19 Oct 2026) - [CVE-2026-112399: Pillow APNG decompression bomb denial of service](https://junglewise.ai/threats/cve-2026-112399-pillow-is-a-python-imaging-library-from-8-1-0-until-13-0-0) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112398: Pillow FlashPix JPEG-tile decoder heap overflow](https://junglewise.ai/threats/cve-2026-112398-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s) (critical, CVSS 4, published 19 Oct 2026) - [CVE-2026-112397: Pillow buffer underflow in ImageMorph.MorphOp.apply](https://junglewise.ai/threats/cve-2026-112397-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112396: Pillow heap use-after-free in TIFF encoding](https://junglewise.ai/threats/cve-2026-112396-pillow-is-a-python-imaging-library-from-11-3-0-until-13-0-0) (medium, CVSS 5.9, published 19 Oct 2026) - [CVE-2026-112395: Pillow tiled-TIFF decoder heap buffer overread](https://junglewise.ai/threats/cve-2026-112395-pillow-is-a-python-imaging-library-from-8-2-0-until-13-0-0) (medium, CVSS 6.5, published 19 Oct 2026) - [CVE-2026-112394: Pillow buffer over-read in P;2L and P;4L raw decoders](https://junglewise.ai/threats/cve-2026-112394-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s-p-2l) (medium, CVSS 4, published 19 Oct 2026) - [CVE-2026-112391: Pillow infinite recursion in PDF parser](https://junglewise.ai/threats/cve-2026-112391-pillow-is-a-python-imaging-library-from-5-1-0-until-13-0-0) (medium, CVSS 4, published 19 Oct 2026) ## Most severe Python Pillow Pillow vulnerabilities - [CVE-2026-96639: Pillow out-of-bounds write in multi-frame image loaders](https://junglewise.ai/threats/cve-2026-96639-pillow-is-a-python-imaging-library-from-11-0-0-until-13-0-0-multi) (critical, CVSS 9.8, published 21 Oct 2026) - [CVE-2026-112398: Pillow FlashPix JPEG-tile decoder heap overflow](https://junglewise.ai/threats/cve-2026-112398-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s) (critical, CVSS 4, published 19 Oct 2026) - [CVE-2026-112397: Pillow buffer underflow in ImageMorph.MorphOp.apply](https://junglewise.ai/threats/cve-2026-112397-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112405: Pillow null pointer dereference in Image.merge()](https://junglewise.ai/threats/cve-2026-112405-pillow-is-a-python-imaging-library-from-12-0-0-until-13-0-0) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112896: Pillow TIFF encoder buffer over-read in ColorMap](https://junglewise.ai/threats/cve-2026-112896-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s-tiff) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-96640: Pillow PDF parser DoS via duplicate page references](https://junglewise.ai/threats/cve-2026-96640-pillow-is-a-python-imaging-library-from-5-1-0-until-13-0-0) (high, CVSS 4, published 21 Oct 2026) - [CVE-2026-96778: Pillow heap overflow in JPEG encoding with ICC profile](https://junglewise.ai/threats/cve-2026-96778-pillow-is-a-python-imaging-library-from-9-4-0-until-13-0-0) (high, CVSS 4, published 21 Oct 2026) - [CVE-2026-96644: Pillow heap buffer over-read in WMF image handler on Windows](https://junglewise.ai/threats/cve-2026-96644-pillow-is-a-python-imaging-library-prior-to-13-0-0-on-windows-src) (high, CVSS 4, published 21 Oct 2026) - [CVE-2026-96637: Pillow memory exhaustion via SPIDER image mode F frame](https://junglewise.ai/threats/cve-2026-96637-pillow-is-a-python-imaging-library-prior-to-13-0-0) (high, CVSS 4, published 21 Oct 2026) - [CVE-2026-96642: Pillow infinite loop in TarIO with negative octal member size](https://junglewise.ai/threats/cve-2026-96642-pillow-is-a-python-imaging-library-prior-to-13-0-0-the-tario) (high, CVSS 4, published 21 Oct 2026) ## Vulnerabilities per week 26 vulnerabilities in the last four weeks, up from none in the four before. 2 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 26 | 2 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Python Pillow Pillow vulnerabilities", https://junglewise.ai/threats/technologies/python-pillow-pillow, 9 November 2026.