StackPrism

PyPI package

pillow 4.1.1 vulnerabilities, and the version that fixes all of them

pillow 4.1.1 has 51 known vulnerabilities (41 rated high or critical); 12.3.0 fixes all of them. CISA lists 2 of them as exploited in the wild.

PyPI (opens in a new tab) describes it as “Python Imaging Library (fork)”

Known vulnerabilities
51
41 rated high or critical
Released
Apr 28, 2017
Latest is 13.0.0
Licence
MIT-CMU
Dependencies
None
Resolved by deps.dev

What to upgrade to

12.3.0 is the closest release with no known vulnerabilities.

  • 4.3.0

    Newest 4.x release. Released Oct 2, 2017.

    54 known vulnerabilities, worst rated warning

  • 12.3.0Upgrade to this

    Fixes all 51 known vulnerabilities. Released Jul 1, 2026.

    No known vulnerabilities

  • 13.0.0

    Latest release. Released Oct 16, 2026.

    No known vulnerabilities

12.3.0 came out on Jul 1, 2026. A coding agent trained before then doesn’t know it exists, so it may suggest an older release. AI knowledge cutoff dates

Hand the fix to your coding agent

One task with the upgrade, the file to change and why. Paste it into Claude Code, Cursor or Codex.

Findings

Every advisory for pillow 4.1.1

Known exploited first (CISA KEV), then by how likely they are to be exploited (FIRST EPSS), then by severity. Each id links to its OSV.dev record.

  1. CriticalPYSEC-2023-175 on OSV.dev (opens in a new tab)Exploited in the wild (CISA)EPSS: top 1%

    Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.

    Fixed in 10.0.1. Published Sep 20, 2023.

  2. CriticalCVE-2023-4863 on OSV.dev (opens in a new tab)CVE-2023-5129Exploited in the wild (CISA)EPSS: top 1%

    libwebp: OOB write in BuildHuffmanTable

    Fixed in 10.0.1. Published Sep 12, 2023.

  3. CriticalCVE-2021-27922 on OSV.dev (opens in a new tab)GHSA-3wvg-mj6g-m9cvEPSS: top 9%

    Pillow Uncontrolled Resource Consumption

    Fixed in 8.1.2. Published Mar 18, 2021.

  4. CriticalCVE-2020-5311 on OSV.dev (opens in a new tab)GHSA-r7rm-8j6h-r933EPSS: top 10%

    Buffer Copy without Checking Size of Input in Pillow

    Fixed in 6.2.2. Published May 24, 2022.

  5. CriticalCVE-2020-5312 on OSV.dev (opens in a new tab)GHSA-p49h-hjvm-jg3hEPSS: top 11%

    PCX P mode buffer overflow in Pillow

    Fixed in 6.2.2. Published Nov 3, 2021.

  6. CriticalCVE-2022-22817 on OSV.dev (opens in a new tab)GHSA-8vj2-vxx3-667wEPSS: top 12%

    Arbitrary expression injection in Pillow

    Fixed in 9.0.1. Published Jan 12, 2022.

  7. CriticalCVE-2021-34552 on OSV.dev (opens in a new tab)GHSA-7534-mm45-c74vEPSS: top 13%

    Buffer Overflow in Pillow

    Fixed in 8.3.0. Published Oct 5, 2021.

  8. WarningCVE-2021-23437 on OSV.dev (opens in a new tab)GHSA-98vv-pw6r-q6q4EPSS: top 13%

    The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.

    Fixed in 8.3.2. Published Sep 3, 2021.

  9. CriticalCVE-2021-27921 on OSV.dev (opens in a new tab)GHSA-f4w8-cv6p-x6r5EPSS: top 13%

    Pillow Denial of Service by Uncontrolled Resource Consumption

    Fixed in 8.1.2. Published Mar 18, 2021.

  10. CriticalCVE-2019-16865 on OSV.dev (opens in a new tab)GHSA-j7mj-748x-7p78EPSS: top 13%

    DOS attack in Pillow when processing specially crafted image files

    Fixed in 6.2.0. Published Oct 22, 2019.

  11. CriticalCVE-2021-27923 on OSV.dev (opens in a new tab)GHSA-95q3-8gr9-gm8wEPSS: top 13%

    Pillow Denial of Service by Uncontrolled Resource Consumption

    Fixed in 8.1.2. Published Mar 18, 2021.

  12. CriticalCVE-2021-25287 on OSV.dev (opens in a new tab)GHSA-77gc-v2xv-rvvhEPSS: top 14%

    Out-of-bounds Read in Pillow

    Fixed in 8.2.0. Published Jun 8, 2021.

  13. CriticalCVE-2020-5313 on OSV.dev (opens in a new tab)GHSA-hj69-c76v-86wrEPSS: top 15%

    Out-of-bounds Read in Pillow

    Fixed in 6.2.2. Published Apr 1, 2020.

  14. CriticalCVE-2022-24303 on OSV.dev (opens in a new tab)GHSA-9j59-75qj-795wEPSS: top 15%

    Path traversal in Pillow

    Fixed in 9.0.1. Published Mar 11, 2022.

  15. WarningCVE-2022-22815 on OSV.dev (opens in a new tab)GHSA-pw3c-h7wp-cvhxEPSS: top 16%

    Improper Initialization in Pillow

    Fixed in 9.0.0. Published Jan 12, 2022.

  16. CriticalCVE-2020-11538 on OSV.dev (opens in a new tab)GHSA-43fq-w8qq-v88hEPSS: top 16%

    Out-of-bounds read in Pillow

    Fixed in 7.1.0. Published Jul 27, 2020.

  17. CriticalCVE-2021-28676 on OSV.dev (opens in a new tab)GHSA-7r7m-5h27-29hpEPSS: top 16%

    Potential infinite loop in Pillow

    Fixed in 8.2.0. Published Jun 8, 2021.

  18. CriticalCVE-2021-25288 on OSV.dev (opens in a new tab)GHSA-rwv7-3v45-hg29EPSS: top 17%

    Pillow Out-of-bounds Read vulnerability

    Fixed in 8.2.0. Published Jun 8, 2021.

  19. CriticalCVE-2021-25290 on OSV.dev (opens in a new tab)GHSA-8xjq-8fcg-g5hwEPSS: top 17%

    Out-of-bounds Write in Pillow

    Fixed in 8.1.1. Published Mar 29, 2021.

  20. CriticalCVE-2021-25289 on OSV.dev (opens in a new tab)GHSA-57h3-9rgr-c24mEPSS: top 17%

    Out of bounds write in Pillow

    Fixed in 8.1.1. Published Mar 29, 2021.

  21. CriticalCVE-2021-28677 on OSV.dev (opens in a new tab)GHSA-q5hq-fp76-qmrcEPSS: top 17%

    Uncontrolled Resource Consumption in Pillow

    Fixed in 8.2.0. Published Jun 8, 2021.

  22. CriticalCVE-2019-19911 on OSV.dev (opens in a new tab)GHSA-5gm3-px64-rw72EPSS: top 19%

    Uncontrolled Resource Consumption in Pillow

    Fixed in 6.2.2. Published Apr 1, 2020.

  23. CriticalCVE-2020-5310 on OSV.dev (opens in a new tab)GHSA-vcqg-3p29-xw73EPSS: top 20%

    Integer overflow in Pillow

    Fixed in 6.2.2. Published Nov 3, 2021.

  24. WarningCVE-2022-22816 on OSV.dev (opens in a new tab)GHSA-xrcv-f9gm-v42cEPSS: top 21%

    Out-of-bounds Read in Pillow

    Fixed in 9.0.0. Published Jan 12, 2022.

  25. CriticalCVE-2020-35654 on OSV.dev (opens in a new tab)GHSA-vqcj-wrf2-7v73EPSS: top 22%

    Pillow Out-of-bounds Write

    Fixed in 8.1.0. Published Mar 18, 2021.

  26. CriticalCVE-2023-50447 on OSV.dev (opens in a new tab)GHSA-3f63-hfp8-52jqEPSS: top 24%

    Arbitrary Code Execution in Pillow

    Fixed in 10.2.0. Published Jan 19, 2024.

  27. CriticalCVE-2020-35653 on OSV.dev (opens in a new tab)GHSA-f5g8-5qq7-938wEPSS: top 25%

    Pillow Out-of-bounds Read

    Fixed in 8.1.0. Published Mar 18, 2021.

  28. WarningCVE-2021-25292 on OSV.dev (opens in a new tab)GHSA-9hx2-hgq2-2g4fEPSS: top 25%

    An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.

    Fixed in 8.1.1. Published Mar 19, 2021.

  29. WarningCVE-2021-25293 on OSV.dev (opens in a new tab)GHSA-p43w-g3c5-g5mqEPSS: top 25%

    An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.

    Fixed in 8.1.1. Published Mar 19, 2021.

  30. CriticalCVE-2020-10177 on OSV.dev (opens in a new tab)GHSA-cqhg-xjhh-p8hfEPSS: top 27%

    Out-of-bounds reads in Pillow

    Fixed in 7.1.0. Published Jul 27, 2020.

  31. CriticalCVE-2020-10994 on OSV.dev (opens in a new tab)GHSA-vj42-xq3r-hr3rEPSS: top 28%

    Out-of-bounds reads in Pillow

    Fixed in 7.1.0. Published Jul 27, 2020.

  32. CriticalCVE-2021-25291 on OSV.dev (opens in a new tab)GHSA-mvg9-xffr-p774EPSS: top 29%

    Out of bounds read in Pillow

    Fixed in 8.2.0. Published Mar 29, 2021.

  33. CriticalCVE-2022-45198 on OSV.dev (opens in a new tab)GHSA-m2vv-5vj5-2hm7EPSS: top 31%

    Pillow vulnerable to Data Amplification attack.

    Fixed in 9.2.0. Published Nov 14, 2022.

  34. CriticalCVE-2023-44271 on OSV.dev (opens in a new tab)GHSA-8ghj-p4vj-mr35EPSS: top 35%

    Pillow Denial of Service vulnerability

    Fixed in 10.0.0. Published Nov 3, 2023.

  35. CriticalCVE-2020-10379 on OSV.dev (opens in a new tab)GHSA-8843-m7mw-mxqmEPSS: top 35%

    Buffer overflow in Pillow

    Fixed in 7.1.0. Published Jul 27, 2020.

  36. CriticalCVE-2020-10378 on OSV.dev (opens in a new tab)GHSA-3xv8-3j54-hgrpEPSS: top 35%

    Out-of-bounds read in Pillow

    Fixed in 7.1.0. Published Nov 3, 2021.

  37. CriticalCVE-2024-28219 on OSV.dev (opens in a new tab)GHSA-44wm-f244-xhp3EPSS: top 38%

    Pillow buffer overflow vulnerability

    Fixed in 10.3.0. Published Apr 3, 2024.

  38. CriticalCVE-2021-28675 on OSV.dev (opens in a new tab)GHSA-g6rj-rv7j-xwp4EPSS: top 40%

    Pillow denial of service

    Fixed in 8.2.0. Published Jun 8, 2021.

  39. WarningCVE-2021-28678 on OSV.dev (opens in a new tab)GHSA-hjfx-8p6c-g7gxEPSS: top 47%

    An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decode…

    Fixed in 8.2.0. Published Jun 2, 2021.

  40. CriticalCVE-2026-54058 on OSV.dev (opens in a new tab)GHSA-62p4-gmf7-7g93EPSS: top 58%

    Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

    Fixed in 12.3.0. Published Jul 20, 2026.

  41. CriticalCVE-2026-59197 on OSV.dev (opens in a new tab)GHSA-xj96-63gp-2gmrEPSS: top 63%

    Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

    Fixed in 12.3.0. Published Jul 20, 2026.

  42. CriticalCVE-2026-55379 on OSV.dev (opens in a new tab)GHSA-45hq-cxwh-f6vcEPSS: top 65%

    Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

    Fixed in 12.3.0. Published Jul 20, 2026.

  43. CriticalCVE-2026-55380 on OSV.dev (opens in a new tab)GHSA-phj9-mv4w-65pmEPSS: top 66%

    Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`

    Fixed in 12.3.0. Published Jul 20, 2026.

  44. CriticalCVE-2026-54060 on OSV.dev (opens in a new tab)GHSA-5x94-69rx-g8h2EPSS: top 66%

    Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

    Fixed in 12.3.0. Published Jul 20, 2026.

  45. CriticalCVE-2026-54059 on OSV.dev (opens in a new tab)GHSA-8v84-f9pq-wr9xEPSS: top 67%

    Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

    Fixed in 12.3.0. Published Jul 20, 2026.

  46. CriticalCVE-2026-59205 on OSV.dev (opens in a new tab)GHSA-9hw9-ch79-4vh6EPSS: top 69%

    Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch

    Fixed in 12.3.0. Published Jul 20, 2026.

  47. CriticalCVE-2026-59199 on OSV.dev (opens in a new tab)GHSA-6r8x-57c9-28j4EPSS: top 69%

    Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

    Fixed in 12.3.0. Published Jul 20, 2026.

  48. WarningCVE-2026-55798 on OSV.dev (opens in a new tab)GHSA-4x4j-2g7c-83w6EPSS: top 94%

    Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

    Fixed in 12.3.0. Published Jul 20, 2026.

  49. WarningCVE-2026-42308 on OSV.dev (opens in a new tab)GHSA-wjx4-4jcj-g98jEPSS: top 96%

    Pillow has an integer overflow when processing fonts

    Fixed in 12.2.0. Published May 4, 2026.

  50. WarningGHSA-jgpv-4h4c-xhw3 on OSV.dev (opens in a new tab)

    Uncontrolled Resource Consumption in pillow

    Fixed in 8.1.2. Published Apr 23, 2021.

  51. LowGHSA-4fx9-vc88-q2xc on OSV.dev (opens in a new tab)

    Infinite loop in Pillow

    Fixed in 9.0.0. Published Mar 11, 2022.

Is pillow the only one?

Paste a public GitHub repo or drop your requirements.txt or pyproject.toml and see every vulnerable, end-of-life or deprecated dependency, with one fix task. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism asks OSV.dev which advisories affect exactly pillow 4.1.1, merges duplicates filed under several ids, and ranks them with CISA’s Known Exploited Vulnerabilities list and FIRST EPSS. Release dates and deprecation come from deps.dev and PyPI. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against PyPI, OSV.dev, deps.dev, CISA KEV and FIRST EPSS.