CVE-2022-30595 Buffer over-flow in Pillow
A heap buffer overflow in Pillow allows attackers to execute arbitrary code or cause denial of service via malicious TGA images.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-30595?
CVE-2022-30595 is a critical memory corruption vulnerability in Python Pillow, published on 25 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.
Weakness: CWE-787
Which versions are affected by CVE-2022-30595?
4 open source packages ship an affected version, including pillow and Pillow. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pillow Bitnami | From 9.1.0 | 9.1.1 |
pillow PyPI | From 9.1.0 | 9.1.1 |
pillow PyPI | From 9.1.0 | 9.1.1 |
Pillow PyPI | From 9.1.0 | 9.1.1 |
Linux distribution packages (1)
python-Pillow openSUSE:Tumbleweed | All versions | 9.1.1-1.1 |
Products include Python Pillow.
How do I fix CVE-2022-30595?
Upgrade pillow to 9.1.1 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-30595 being exploited?
There is no known exploitation of CVE-2022-30595 in the wild and no public exploit code.
Other vulnerabilities in Python Pillow
- CVE-2014-3007 Pillow command injection
- CVE-2026-96639 Pillow multi-frame loaders can reuse stale native image storage after mode transitions
- CVE-2021-25289 Out of bounds write in Pillow
- CVE-2016-4009 Pillow Integer overflow in ImagingResampleHorizontal
- CVE-2026-112393 Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
Sources
Also known as BIT-pillow-2022-30595, DEBIAN-CVE-2022-30595, GHSA-hr8g-f6r6-mr22, PYSEC-2022-43145, openSUSE-SU-2024:12111-1.