# Python Pillow vulnerabilities Source: https://junglewise.ai/threats/vendors/python-pillow Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/python-pillow.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 45 vulnerabilities in Python Pillow: 0 in the last 7 days and 26 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-114501, was published on 21 October 2026. 26 vulnerabilities in the last four weeks, up from none in the four before. 2 critical against 0. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 26 - Last 90 days: 26 - All time: 45 (2 critical, 0 exploited in the wild) ## Latest Python Pillow vulnerabilities - [CVE-2026-114501: Pillow Arrow export memory disclosure via row padding](https://junglewise.ai/threats/cve-2026-114501-pillow-is-a-python-imaging-library-from-11-2-1-until-13-0-0) (medium, CVSS 4, published 21 Oct 2026) - [CVE-2026-96778: Pillow heap overflow in JPEG encoding with ICC profile](https://junglewise.ai/threats/cve-2026-96778-pillow-is-a-python-imaging-library-from-9-4-0-until-13-0-0) (high, CVSS 4, published 21 Oct 2026) - [CVE-2026-96644: Pillow heap buffer over-read in WMF image handler on Windows](https://junglewise.ai/threats/cve-2026-96644-pillow-is-a-python-imaging-library-prior-to-13-0-0-on-windows-src) (high, CVSS 4, published 21 Oct 2026) - [CVE-2026-96642: Pillow infinite loop in TarIO with negative octal member size](https://junglewise.ai/threats/cve-2026-96642-pillow-is-a-python-imaging-library-prior-to-13-0-0-the-tario) (high, CVSS 4, published 21 Oct 2026) - [CVE-2026-96641: Pillow signed integer overflow in PILfont text-width accumulation](https://junglewise.ai/threats/cve-2026-96641-pillow-is-a-python-imaging-library-prior-to-13-0-0-pilfont-text) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-96640: Pillow PDF parser DoS via duplicate page references](https://junglewise.ai/threats/cve-2026-96640-pillow-is-a-python-imaging-library-from-5-1-0-until-13-0-0) (high, CVSS 4, published 21 Oct 2026) - [CVE-2026-96639: Pillow out-of-bounds write in multi-frame image loaders](https://junglewise.ai/threats/cve-2026-96639-pillow-is-a-python-imaging-library-from-11-0-0-until-13-0-0-multi) (critical, CVSS 9.8, published 21 Oct 2026) - [CVE-2026-96638: Pillow BMP RLE decoder memory exhaustion](https://junglewise.ai/threats/cve-2026-96638-pillow-is-a-python-imaging-library-from-9-1-0-until-13-0-0) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-96637: Pillow memory exhaustion via SPIDER image mode F frame](https://junglewise.ai/threats/cve-2026-96637-pillow-is-a-python-imaging-library-prior-to-13-0-0) (high, CVSS 4, published 21 Oct 2026) - [CVE-2026-112898: Pillow information disclosure in quantize with empty palette](https://junglewise.ai/threats/cve-2026-112898-pillow-is-a-python-imaging-library-from-9-1-0-until-13-0-0) (medium, CVSS 4, published 19 Oct 2026) - [CVE-2026-112897: Pillow uninitialized memory disclosure in TIFF decoding](https://junglewise.ai/threats/cve-2026-112897-pillow-is-a-python-imaging-library-from-5-3-0-until-13-0-0) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112896: Pillow TIFF encoder buffer over-read in ColorMap](https://junglewise.ai/threats/cve-2026-112896-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s-tiff) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112892: Pillow MSP RLE decoder memory exhaustion](https://junglewise.ai/threats/cve-2026-112892-pillow-is-a-python-imaging-library-from-4-1-0-until-13-0-0) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112891: Pillow quadratic copying in GIF comment handling](https://junglewise.ai/threats/cve-2026-112891-pillow-is-a-python-imaging-library-from-9-2-0-until-13-0-0) (medium, CVSS 4, published 19 Oct 2026) - [CVE-2026-112406: Pillow infinite loop in PDF page rewriting](https://junglewise.ai/threats/cve-2026-112406-pillow-is-a-python-imaging-library-from-5-1-0-until-13-0-0) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112405: Pillow null pointer dereference in Image.merge()](https://junglewise.ai/threats/cve-2026-112405-pillow-is-a-python-imaging-library-from-12-0-0-until-13-0-0) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112404: Pillow TIFF tile and RGBA decode heap buffer over-read](https://junglewise.ai/threats/cve-2026-112404-pillow-is-a-python-imaging-library-from-8-1-0-until-13-0-0) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112401: Pillow quadratic copying in GIF comment parsing](https://junglewise.ai/threats/cve-2026-112401-pillow-is-a-python-imaging-library-from-5-4-0-until-13-0-0) (medium, CVSS 4, published 19 Oct 2026) - [CVE-2026-112399: Pillow APNG decompression bomb denial of service](https://junglewise.ai/threats/cve-2026-112399-pillow-is-a-python-imaging-library-from-8-1-0-until-13-0-0) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112398: Pillow FlashPix JPEG-tile decoder heap overflow](https://junglewise.ai/threats/cve-2026-112398-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s) (critical, CVSS 4, published 19 Oct 2026) - [CVE-2026-112397: Pillow buffer underflow in ImageMorph.MorphOp.apply](https://junglewise.ai/threats/cve-2026-112397-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s) (high, CVSS 4, published 19 Oct 2026) - [CVE-2026-112396: Pillow heap use-after-free in TIFF encoding](https://junglewise.ai/threats/cve-2026-112396-pillow-is-a-python-imaging-library-from-11-3-0-until-13-0-0) (medium, CVSS 5.9, published 19 Oct 2026) - [CVE-2026-112395: Pillow tiled-TIFF decoder heap buffer overread](https://junglewise.ai/threats/cve-2026-112395-pillow-is-a-python-imaging-library-from-8-2-0-until-13-0-0) (medium, CVSS 6.5, published 19 Oct 2026) - [CVE-2026-112394: Pillow buffer over-read in P;2L and P;4L raw decoders](https://junglewise.ai/threats/cve-2026-112394-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s-p-2l) (medium, CVSS 4, published 19 Oct 2026) - [CVE-2026-112391: Pillow infinite recursion in PDF parser](https://junglewise.ai/threats/cve-2026-112391-pillow-is-a-python-imaging-library-from-5-1-0-until-13-0-0) (medium, CVSS 4, published 19 Oct 2026) ## Most severe Python Pillow vulnerabilities - [CVE-2026-96639: Pillow out-of-bounds write in multi-frame image loaders](https://junglewise.ai/threats/cve-2026-96639-pillow-is-a-python-imaging-library-from-11-0-0-until-13-0-0-multi) (critical, CVSS 9.8, published 21 Oct 2026) - [CVE-2026-112398: Pillow FlashPix JPEG-tile decoder heap overflow](https://junglewise.ai/threats/cve-2026-112398-pillow-is-a-python-imaging-library-prior-to-13-0-0-pillow-s) (critical, CVSS 4, published 19 Oct 2026) - [CVE-2026-59197: python-pillow Pillow heap out-of-bounds write in RankFilter](https://junglewise.ai/threats/cve-2026-59197-python-pillow-pillow-heap-out-of-bounds-write-in-rankfilter) (high, CVSS 8.2, published 14 Jul 2026) - [CVE-2026-42311: Pillow integer overflow and OOB write in PSD processing](https://junglewise.ai/threats/cve-2026-42311-pillow-integer-overflow-and-oob-write-in-psd-processing) (high, CVSS 7.8, published 9 May 2026) - [CVE-2026-40192: Python Pillow denial of service via FITS GZIP decompression bomb](https://junglewise.ai/threats/cve-2026-40192-python-pillow-denial-of-service-via-fits-gzip-decompression-bomb) (high, CVSS 7.5, published 15 Apr 2026) - [CVE-2026-59200: python-pillow Pillow denial of service in PdfParser](https://junglewise.ai/threats/cve-2026-59200-python-pillow-pillow-denial-of-service-in-pdfparser) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2026-59205: Pillow heap corruption in ImageCmsTransform.apply](https://junglewise.ai/threats/cve-2026-59205-pillow-heap-corruption-in-imagecmstransform-apply) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2026-59199: Pillow heap out-of-bounds write in image coordinate APIs](https://junglewise.ai/threats/cve-2026-59199-pillow-heap-out-of-bounds-write-in-image-coordinate-apis) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2026-55379: Pillow decompression bomb protection bypass in BdfFontFile](https://junglewise.ai/threats/cve-2026-55379-pillow-decompression-bomb-protection-bypass-in-bdffontfile) (high, CVSS 7.5, published 6 Jul 2026) - [CVE-2026-55380: Pillow heap allocation overflow in GdImageFile decompression bomb check](https://junglewise.ai/threats/cve-2026-55380-pillow-heap-allocation-overflow-in-gdimagefile-decompression-bomb) (high, CVSS 7.5, published 6 Jul 2026) ## Vulnerabilities per week 26 vulnerabilities in the last four weeks, up from none in the four before. 2 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 26 | 2 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Python Pillow technologies - [Python Pillow Pillow](https://junglewise.ai/threats/technologies/python-pillow-pillow): 26 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Python Pillow vulnerabilities", https://junglewise.ai/threats/vendors/python-pillow, 9 November 2026.