# Python Pillow


- [CVE-2014-3007](https://insights.sbomify.com/CVE-2014-3007/): Pillow command injection (critical 10.0)
- [CVE-2026-96639](https://insights.sbomify.com/CVE-2026-96639/): Pillow multi-frame loaders can reuse stale native image storage after mode transitions (critical 9.8)
- [CVE-2022-30595](https://insights.sbomify.com/CVE-2022-30595/): Buffer over-flow in Pillow (critical 9.8)
- [CVE-2022-22817](https://insights.sbomify.com/CVE-2022-22817/): Arbitrary expression injection in Pillow (critical 9.8)
- [CVE-2021-34552](https://insights.sbomify.com/CVE-2021-34552/): Buffer Overflow in Pillow (critical 9.8)
- [CVE-2021-25289](https://insights.sbomify.com/CVE-2021-25289/): Out of bounds write in Pillow (critical 9.8)
- [CVE-2020-5311](https://insights.sbomify.com/CVE-2020-5311/): Buffer Copy without Checking Size of Input in Pillow (critical 9.8)
- [CVE-2020-5312](https://insights.sbomify.com/CVE-2020-5312/): PCX P mode buffer overflow in Pillow (critical 9.8)
- [CVE-2016-4009](https://insights.sbomify.com/CVE-2016-4009/): Pillow Integer overflow in ImagingResampleHorizontal (critical 9.8)
- [CVE-2026-112393](https://insights.sbomify.com/CVE-2026-112393/): Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (critical 9.2)
- [CVE-2026-112398](https://insights.sbomify.com/CVE-2026-112398/): Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution (critical 9.2)
- [CVE-2026-112403](https://insights.sbomify.com/CVE-2026-112403/): Pillow: Heap buffer overflow in ImagingJpegDecode (critical 9.2)

---
From sbomify Insights: https://insights.sbomify.com/products/python/pillow/